EC isn't great for privacy either...

> Wow! And "Gulp." I may have to get my European Community passport
> sooner than I had planned. Does Martinique have a Net connection?

Don't rush out to get your EC passport yet. Below I have included some
exerpts from the EC Information Technology Security Document (ITSEC, aka
Green Book). The referenced sections are from the "Confidentiality" section.
I have put "..."'s where I have skipped over material and all upper case
words are emphasis that I have added.

For those who don't want to read it all, the gist of it is that the EC
folks are also interested in maintaining the government's ability to
intercept private communications. There is also talk about licensing
businesses to use good confidentiality services. Btw. There is also
a mention of PGP which I have left. Its the paragraph right before the
one that mentions Clipper!

--Begin Enclosure
\subsection{Privacy enhancement issues}

\subsubsection{Perception of requirements for privacy enhancement}

\SeiLa{Issue}

Confidentiality is, at times, essential for the good functioning of
administrations, business and human relations.
...
Most business and private users of communication systems are aware of
the conflict between their confidentiality requirements and national
security issues which require the possibility to intercept the
communication in a way regulated by national laws. They accept the
national authorities ability for this interception provided there are
adequate safeguards to prevent unauthorised interception even by
government employees.
...
{\bf Service provision}

The extent to which confidentiality services are provided for a
specific business or citizen could depend on a system of LICENSES or
certificates.

A particular business might qualify for a CONFIDENTIALITY LICENSE
depending on its internal procedures and activities. A general
(minimum) level of confidentiality could be provided to all users.

It should be possible for certain user groups or businesses to use
other confidential services (egproprietary) than the standard ones
provided.

There are strong indications of emerging ``bottom up'' solutions for
these needs (eg the Pretty Good Privacy offering on Internet,
beginning 1993).

Other initiatives (eg the announcement of the ``Clipper Chip'', 16 April
1993) illustrate the growing awareness of governments of the needs of
their citizens for confidentiality services.
...
If a public confidentiality scheme is offered, organised crime could
also subscribe to such a scheme, but as it would include provisions
for legal intercept, it would hardly be attractive. One would expect
that such users would continue to find their own solutions as will the
classified domain.

An open and public service offering a credible level of
confidentiality would therefore provide for the honest user, while not
worsening the situation with respect to public order or national
security.

The combination of international communication and national security
regulations require a common framework for confidentiality services,
which on the one hand interoperate within all Community Member States
as well as with countries outside the Community which themselves may
establish their confidentiality services. This requires either an
overlay approach or gateways which link the different national or
regional services. These gateways are only required where
multinational agreements for co-operation on national security
concerns is not yet established. In this case these gateways may
provide at least an interim solution.

--End Enclosure

[anonymously quoted EC policy proposal]
>A particular business might qualify for a CONFIDENTIALITY LICENSE
>depending on its internal procedures and activities. A general
>(minimum) level of confidentiality could be provided to all users.

THE HORROR!

*this* is Orwellian. *this* is how to outlaw cryptography. 

we need some ECypherpunk infiltrators ASAP!

Whoever posted this -- can you post more information on where it was
contained to sci.crypt or alt.privacy.clipper, so that we can get a
wider audience? there are probably plenty of Europeans who don't know
about this but should! We need a contact to report to the list!

I speculated on the list some time ago the efforts by NSA to get
Clipper to be an *international* standard. I suggested that the Britain
GCHQ would be the first to endorse it publicly. Sounds like the EC may
beat them to the punch. Was NSA lobbying involved here, or did they
just pick up on this great idea <smirk>?

Also, where was it [Norway?] that lady posted from saying that their
national secret service was pushing a proposal for cryptographic use
similar to Clipper?

In one word, 

YIKES

> [anonymously quoted EC policy proposal]
> >A particular business might qualify for a CONFIDENTIALITY LICENSE
> >depending on its internal procedures and activities. A general
> >(minimum) level of confidentiality could be provided to all users.
> 
> THE HORROR!
> 
> *this* is Orwellian. *this* is how to outlaw cryptography. 
> 
> we need some ECypherpunk infiltrators ASAP!

I would be interested in knowing which EC document is being referred
to. You may perhaps be interested to know that the 14JUL93 Draft 3.6 of
the "Green Book on the Security of Information Systems" (from CEC DGXIIIB)
addresses the issue that "strong information privacy may also be used to
escape investigation by law enforcement". It identifies some related
requirements: "an effective, internationally agreed, economic, ethical,
and usable solution to meet business, administration, and personal needs
including mechanisms for authorised interception and reporting the
incidents and crimes adjusted to the conditions of the Internal Market,
and to include the necessary equipment and software, but also an 
infrastructure of Trusted Third Parties. This will discourage "home made"
or other solutions."

As its name suggests, the Green Book isn't an agreed policy, but is an
intermediate step in the process of constructing and Action Plan for
EC information security. As such, the current text might be interpreted
as a recommendation for EC adoption of a Clipper-style solution, but
this is by no means the only (or even the best) way to meet these
requirements. Personally I would favour a framework which encouraged
strong cryptography, and assumed that criminals will tend to ignore the
law, so therefore didn't burden the law-abiding 99% with pointless
constraints. This would require an adjustment to the current Green Book
requirements, which I, at least, will be suggesting.