Skip to main content

EFFector - Volume 5, Issue 9 - EFF Comments to NIST

==============================================================================
           //////////////     //////////////     //////////////
         ///                ///                ///
       ///////            ///////            ///////
     ///                ///                ///
   //////////////     ///                ///
                  -==--==--==-<>-==--==--==- 
                        In this issue:
                    EFF Comments to NIST
        Computers, Freedom and Privacy Conference 1994
            Summary of Rural Datafications Conference
                   -==--==--==-<>-==--==--==- 

EFF Comments to the NIST (the National Institute of Standards and 
Technology:
          
May 27, 1993

Before the

COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD 
Technology Building, Room B-154
National Institute of Standards and Technology Gaithersburg, MD 
20899

COMMENTS OF THE ELECTRONIC FRONTIER FOUNDATION 

Regarding

Key Escrow Chip Cryptographic Technology and Government 
Cryptographic Policies and Regulations

The Electronic Frontier Foundation (EFF) commends the Computer 
System Security and Privacy Advisory Board for offering the public 
the opportunity to comment on developments in cryptography and 
communications privacy policy. Recent Administration proposals, 
including use of the Clipper Chip and establishment of a government-
controlled key escrow system, raise questions that cut to the core of 
privacy protection in the age of digital communication technology. 
The questions noted by the Advisory Board in its Notice of Open 
Meeting (58 FR 28855) reflect a broad range of concerns, from civil 
liberties to global competitiveness. The Digital Privacy and Security 
Working Group -- a cooperative effort of civil liberties organizations 
and corporate users and developers of communication technology 
which is chaired by the EFF -- has also submitted over one hundred 
questions to the Administration. (These questions are being 
submitted to the Advisory Board under separate cover on behalf of 
the Working Group.) That there are so many questions demonstrates 
the need for a comprehensive review of cryptography and privacy 
policy. 

We are encouraged that the Administration has expressed a 
willingness to undertake such a review. However, it has become clear 
that plans for rapid introduction of the Clipper Chip could 
unacceptably distort this important policy review. The 
Administration has made no secret of the fact that it hopes to use 
government purchasing power to promote Clipper as a de facto 
standard for encryption. With Clipper on the market, the policy 
process will be biased toward a long-term solution such as Clipper 
with key escrow. Moreover, the rush to introduce Clipper is already 
forcing a hasty policy review which may fail to provide adequate 
public dialogue on the fundamental privacy questions which must be 
resolved to reach a satisfactory cryptography policy. Based on the 
depth and complexity of questions raised by this review, EFF 
believes that no solution, with Clipper Chip or otherwise, should be 
adopted by the government until the comprehensive cryptography 
review initiated by the Administration is complete.

EFF is a nonprofit, public interest organization whose public policy 
mission is to insure that the new electronic highways emerging from 
the convergence of telephone, cable, broadcast, and other 
communications technologies enhance free speech and privacy rights, 
and are open and accessible to all segments of society.

In these comments, we will elaborate on questions 1, 2, and 3 listed 
in the Advisory Board's Notice. We offer these comments primarily to 
raise additional questions that must be answered during the course 
of the Administration's policy review.

A. WILL PARTICULAR ENCRYPTION TECHNOLOGIES BE MANDATED OR 
PROSCRIBED?: A THRESHOLD QUESTION

Unraveling the current encryption policy tangle must begin with one 
threshold question: will there come a day when the federal 
government controls the domestic use of encryption through 
mandated key escrow schemes or outright prohibitions against the 
use of particular encryption technologies? Is Clipper the first step in 
this direction? A mandatory encryption regime raises profound 
constitutional questions, some of which we will discuss below. So far, 
the Administration has not declared that use of Clipper will be 
mandatory, but several factors point in that direction:

1. Secrecy of the algorithm justified by need to ensure key escrow 
compliance: 

Many parties have already questioned the need for a secret 
algorithm, especially given the existence of robust, public-domain 
encryption techniques. The most common explanation given for use 
of a secret algorithm is the need to prevent users from by-passing 
the key escrow system proposed along with the Clipper Chip. If the 
system is truly voluntary, then why go to such lengths to ensure 
compliance with the escrow procedure?

2. How does a voluntary system solve law enforcement's problems? 

The major stated rationale for government intervention in the 
domestic encryption arena is to ensure that law enforcement has 
access to criminal communications, even if they are encrypted. Yet, a 
voluntary scheme seems inadequate to meet this goal. Criminals who 
seek to avoid interception and decryption of their communications 
would simply use another system, free from escrow provisions. 
Unless a government-proposed encryption scheme is mandatory, it 
would fail to achieve its primary law enforcement purpose. In a 
voluntary regime, only the law-abiding would use the escrow 
system.

B. POLICY CONCERNS ABOUT GOVERNMENT-RUN KEY ESCROW SYSTEM 

Even if government-proposed encryption standards remain 
voluntary, the use of key escrow systems still raises serious 
concerns: 

1. Is it wise to rely on government agencies, or government-selected 
private institutions to protect the communications privacy of all who 
would someday use a system such as Clipper?

2. Will the public ever trust a secret algorithm with an escrow 
system enough to make such a standard widely used? 

C. CONSTITUTIONAL IMPLICATIONS OF GOVERNMENT CONTROLS ON 
USE OF ENCRYPTION 

Beyond the present voluntary system is the possibility that specific 
government controls on domestic encryption could be enacted. Any 
attempt to mandate a particular cryptographic standard for private 
communications, a requirement that an escrow system be used, or a 
prohibition against the use of specific encryption algorithms, would 
raise fundamental constitutional questions. In order to appreciate the 
importance of the concerns raised, we must recognize that we are 
entering an era in which most of society will rely on encryption to 
protect the privacy of their electronic communications. The following 
questions arise: 

1. Does a key escrow system force a mass waiver of all users' Fifth 
Amendment right against self-incrimination? 

The Fifth Amendment protects individuals facing criminal charges 
from having to reveal information which might incriminate them at 
trial. So far, no court has determined whether or not the Fifth 
Amendment allows a defendant to refuse to disclose his or her 
cryptographic key. As society and technology have changed, courts 
and legislatures have gradually adapted fundamental constitutional 
rights to new circumstances. The age of digital communications 
brings many such challenges to be resolved. Such decisions require 
careful, deliberate action. But the existence of a key escrow system 
would have the effect of waiving this right for every person who 
used the system in a single step. We believe that this question 
certainly deserves more discussion.

2. Does a mandatory key escrow system violate the Fourth 
Amendment prohibition against "unreasonable search and seizure"? 

In the era where people work for "virtual corporations" and conduct 
personal and political lives in cyberspace, the distinction between 
communication of information and storage of information is 
increasingly vague. The organization in which one works or lives may 
constitute a single virtual space, but be physically dispersed. So, the 
papers and files of the organization or individual may be moved 
within the organization by means of telecommunications technology. 
Until now, the law of search and seizure has made a sharp distinction 
between, on the one hand, seizures of papers and other items in a 
person's physical possession, and on the other hand, wiretapping of 
communications. Seizure of papers or personal effects must be 
conducted with the owner's knowledge, upon presentation of a 
search warrant. Only in the exceptional case of wiretapping, may a 
person's privacy be invaded by law enforcement without 
simultaneously informing the target. Instantaneous access to 
encryption keys, without prior notice to the communicating parties, 
may well constitute a secret search, if the target is a virtual 
organization or an individual whose "papers" are physically 
dispersed. Under the Fourth Amendment, secret searches are 
unconstitutional. 

3. Does prohibition against use of certain cryptographic techniques 
infringe individuals' right to free speech? 

Any government restriction on or control of speech is to be regarded 
with the utmost scrutiny. Prohibiting the use of a particular form of 
cryptography for the express purpose of making communication 
intelligible to law enforcement is akin to prohibiting anyone from 
speaking a language not understood by law enforcement. Some may 
argue that cryptography limitations are controls on the "time, place 
and manner" of speech, and therefore subject to a more lenient legal 
standard. However, time, place and manner restrictions that have 
been upheld by courts include laws which limit the volume of 
speakers from interfering with surrounding activities, or those which 
confine demonstrators to certain physical areas. 
No court has ever upheld an outright ban on the use of a particular 
language. Moreover, even a time, place and manner restriction must 
be shown to be the "least restrictive means" of accomplishing the 
government's goal. It is precisely this question -- the availability of 
alternatives which could solve law enforcement's actual problems -- 
that must be explored before a solution such as Clipper is promoted. 

D. PUBLIC PROCESS FOR CRYPTOGRAPHY POLICY 

As this Advisory Board is well aware, the Computer Security Act of 
1987 clearly established that neither military nor law enforcement 
agencies are the proper protectors of personal privacy. When 
considering the law, Congress asked, "whether it is proper for a 
super-secret agency [the NSA] that operates without public scrutiny 
to involve itself in domestic activities...?" The answer was a clear 
"no." Recent Administration announcements regarding the Clipper 
Chip suggest that the principle established in the 1987 Act has been 
circumvented. For example, this Advisory Board was not consulted 
with until after public outcry over the Clipper announcements. Not 
only does the initial failure to consult eschew the guidance of the 
1987 Act, but also it ignored the fact that this Advisory Board was 
already in the process of conducting a cryptography review.

As important as the principle of civilian control was in 1987, it is 
even more critical today. The more individuals around the country 
come to depend on secure communications to protect their privacy, 
the more important it is to conduct privacy and security policy 
dialogues in public, civilian forums.

CONCLUSION

The EFF thanks the Advisory Board for the opportunity to comment 
on these critical public policy issues. In light of the wide range of 
difficult issues raised in this inquiry, we encourage the Advisory 
Board to call on the Administration to delay the introduction of 
Clipper-based products until a thorough, public dialogue on 
encryption and privacy policy has been completed.

Respectfully Submitted,

Electronic Frontier Foundation

Jerry Berman
Executive Director
jberman@eff.org

Daniel J. Weitzner
Senior Staff Counsel
djw@eff.org

                    -==--==--==-<>-==--==--==- 

Computers, Freedom and Privacy '94 Announcement

The fourth annual conference, "Computers, Freedom, and Privacy," 
will be held in Chicago, Il., March 23-26, 1994. This conference will 
be jointly sponsored by the Association for Computing Machinery 
(ACM) and The John Marshall Law School. George B. Trubow, 
professor of law and director of the Center for Informatics Law at 
John Marshall, is general chairman of the conference. The series 
began in 1991 with a conference in Los Angeles, and subsequent 
meetings took place in Washington, D.C., and San Francisco, in 
successive years. Each conference has addressed a broad range of 
issues confronting the "information society" in this era of the 
computer revolution. 

The advance of computer and communications technologies holds 
great promise for individuals and society. From conveniences for 
consumers and efficiencies in commerce to improved public health 
and safety and increased knowledge of and participation in 
government and community, these technologies are fundamentally 
transforming our environment and our lives. 

At the same time, these technologies present challenges to the idea 
of a free and open society. Personal privacy is increasingly at risk 
from invasions by high-tech surveillance and monitoring; a myriad of 
personal information data bases expose private life to constant 
scrutiny; new forms of illegal activity may threaten the traditional 
barriers between citizen and state and present new tests of 
Constitutional protection; geographic boundaries of state and nation 
may be recast by information exchange that knows no boundaries as 
governments and economies are caught up in global data networks.

Computers, Freedom, and Privacy '94 will present an assemblage of 
experts, advocates and interested parties from diverse perspectives 
and disciplines to consider the effects on freedom and privacy 
resulting from the rapid technological advances in computer and 
telecommunication science. Participants come from fields of 
computer science, communications, law, business and commerce, 
research, government, education, the media, health, public advocacy 
and consumer affairs, and a variety of other backgrounds. A series of 
pre-conference tutorials will be offered on March 23, 1994, with the 
conference program beginning on Thursday, March 24, and running 
through Saturday, March 26, 1994.

The emphasis in '94 will be on examining the many potential uses of 
new technology and considering recommendations for dealing with 
them. "We will be looking for specific suggestions to harness the new 
technologies so society can enjoy the benefits while avoiding 
negative implications," said Trubow. "We must manage the 
technology, or it will manage us," he added. 

Trubow is putting out a call for papers or program suggestions. 
"Anyone who is doing a paper relevant to our subject matter, or who 
has an idea for a program presentation that will demonstrate new 
computer or communications technology and suggest what can be 
done with it, is invited to let us know about it." Any proposal must 
state the title of the paper or program, describe the theme and 
content in a short paragraph, and set out the credentials and 
experience of the author or suggested speakers. Conference 
communications should be sent to:

CFP'94
John Marshall Law School
315 S. Plymouth Ct.
Chicago, IL 60604
(Voice: 312-987-1419; Fax: 312-427-8307; E-mail: CFP94@jmls.edu) 

Trubow anticipates that announcement of a student writing 
competition for CFP'94 will be made soon, together with information 
regarding the availability of a limited number of student 
scholarships for the conference. Trubow said, "I expect the 
organizational structure for CFP'94, including the designation of 
program committees, to be completed by about the first of August, to 
allow plenty of time for the development of a stimulating and 
informative conference."

The venerable Palmer House, a Hilton hotel located at the corner of 
State Street and Washington Ave. in Chicago's "loop," and only about 
a block from the John Marshall Law School buildings, will be the 
conference headquarters. Room reservations should be made directly 
with the hotel, mentioning John Marshall Law School or "CFP'94" to 
get the special conference rate of $99.00, plus tax. 

The Palmer House Hilton
17 E. Monroe., Chicago, Il., 60603
Tel: 312-726-7500; 1-800-HILTONS; Fax 312-263-2556 

                    -==--==--==-<>-==--==--==- 

Preliminary Report -- Rural Datafication Conference 
Chicago, May 13 & 14, 1993

Over 200 hundred people from all over the United States and Canada 
gathered in Chicago last week to participate in _Rural Datafication: 
achieving the goal of ubiquitous access to the Internet_. The 
conference was sponsored by CICNet and nine cooperating state 
communications networks or organizations: NetILLINOIS, INDNet, 
IREN, MichNet, MRNet, NYSERNet, PREPnet, WiscNet, and WVNET. Two 
of the represented states (Minnesota and Indiana) took the 
opportunity to caucus among themselves to further define their own 
activities.

The program began Thursday afternoon with hosted discussion 
groups intended to discover where we could make improvements in 
networked information services. Then a panel described current 
successful projects in British Columbia (Roger Hart), North Dakota 
(Dan Pullen), Montana (Frank Odasz), Washington, Alaska, and Oregon 
(Sherrilynne Fuller), Pennsylvania (Art Hussey), and Massachusetts 
(Miles Fidelman). Questions from the panel and the audience would 
have kept the room filled far into the night had the moderator not 
sent everyone out to dinner. 

The next morning's sessions featured knowledgeable speakers open 
to interaction with the other conference attendees. Mike Staman set 
the stage. He was followed by Ross Stapleton who spoke about 
recognizing that our government is also not well-networked; by 
Simona Nass who spoke about some of the legal and policy issues of 
networked communities; by Anthony Riddle who spoke about how 
the networked information community could build from the 
experiences of the community access television people; and by 
George Baldwin who spoke about using networked information to 
preserve Native American cultures. Rick Gates finished up the 
morning with a presentation that described his efforts to teach 
information discovery on the nets using play.

The afternoon session featured reports from the hosted discussion 
groups on agriculture, on health care and health education, on 
libraries, on post-secondary education, on community and 
government information, and on K-12 education. Joel Hartman of 
Bradley University and netILLINOIS moderated.

The interaction among the attendees and between and with the 
speakers and panelists brought the most benefit, according to some 
attendees. The attendees recognized that we haven't quite figured 
out how to solve the extensive problems that bar network access to 
all but they are excited about continuing to identify and work on 
removing the barriers. A number suggested that the meeting should 
actually be the first Rural Datafication Conference and offered to host 
and/or organize the anticipated follow-on meeting next year. Many 
offered format and speaker suggestions for that meeting and look 
forward to the anticipated proceedings from the conference which 
CICNet expects to publish.

CICNet is working on a summary of the meeting and working to build 
a gopher/ftp-archive and printed version of the meeting. We'll 
announce the availability of those versions as soon as we can. Thanks 
to all the participants for a successful meeting and to all of you who 
have expressed interest but couldn't come.
____________________________
Glee Harrah Cady, Manager, Information Services, CICNet 2901 
Hubbard, Ann Arbor, MI 48105	+1.313.998.6419
glee@cic.net

=============================================================

     EFFector Online is published by
     The Electronic Frontier Foundation
     666 Pennsylvania Ave. SE  Suite 303
     Washington, DC 20003 USA
     Phone: +1 202 544 9237 FAX: +1 202 547 5481
     Internet Address: eff@eff.org
     Coordination, production and shipping by Cliff Figallo, EFF 
     Online Communications Coordinator (fig@eff.org)
 Reproduction of this publication in electronic media is encouraged.
 Signed articles do not necessarily represent the view of the EFF.
 To reproduce signed articles individually, please contact the authors
 for their express permission.

      *This newsletter is printed on 100% recycled electrons*
=============================================================

        MEMBERSHIP IN THE ELECTRONIC FRONTIER FOUNDATION

In order to continue the work already begun and to expand our 
efforts and activities into other realms of the electronic frontier, we 
need the financial support of individuals and organizations.

If you support our goals and our work, you can show that support by
becoming a member now. Members receive our bi-weekly electronic 
newsletter, EFFector Online (if you have an electronic address that 
can be reached through the Net), and special releases and other 
notices on our activities.  But because we believe that support should 
be freely given, you can receive these things even if you do not elect 
to become a member.

Your membership/donation is fully tax deductible.

Our memberships are $20.00 per year for students and $40.00 per 
year for regular members.  You may, of course, donate more if you 
wish.

Our privacy policy: The Electronic Frontier Foundation will never, 
under any circumstances, sell any part of its membership list.  We 
will,  from time to time, share this list with other non-profit 
organizations  whose work we determine to be in line with our goals.  
But with us,  member privacy is the default. This means that you 
must actively grant us permission to share your name with other 
groups. If you do not  grant explicit permission, we assume that you 
do not wish your  membership disclosed to any group for any reason.

=============================================================
Mail to: 
         Membership Coordinator
         The Electronic Frontier Foundation
         666 Pennsylvania Ave. SE Suite 303
         Washington, DC 20003 USA


I wish to become a member of the EFF.  I enclose: $_______
I wish to renew my membership in the EFF.  I enclose: $_______
            $20.00 (student or low income membership)
            $40.00 (regular membership)

    [  ] I enclose an additional donation of $_______

Name:

Organization:

Address:

City or Town:

State:       Zip:      Phone: (    )             (optional)

FAX: (    )              (optional)

Email address:

I enclose a check [  ].
Please charge my membership in the amount of $
to my Mastercard [  ]  Visa [  ]  American Express [  ]

Number:

Expiration date:

Signature: ________________________________________________

Date:

I hereby grant permission to the EFF to share my name with
other non-profit groups from time to time as it deems
appropriate   [ ].
                       Initials:___________________________
JavaScript license information