EFF pornography file warning

Boy, I sure have gotten flamed by the best on this one. And its rather
deafeningly silent on the list. I'm bleeding from shrapnel wounds and
hung out to die. Let me justify a few things. Enclosed:

- why I posted the announcement
- why I flamed EFF
- things that have upset me about this affair
- a classic cypherpunk rant on child pornography worthy of T.C. May

* * *

I posted the announcement to the cypherpunks because

1) there has been a long past history of interest in BBS type investigations

2) there was a huge flame war over CERT sending a notice to E.Hughes
for his FTP site, saying `please look into this'-- this EFF
announcement struck me as amazingly similar. (BTW, I had virtually
nothing to do with that flame war, which was incredibly prolonged)

3) EFF of course is very close to the cypherpunk cause with S.Steele,
M.Godwin, and J.Gilmore regular readers and contributors.

4) consider that comp.org.eff.talk would be another forum, but I
rejected it, because this forum is more private and still watched by EFF.

* * *

Now, why did I flame EFF for this action? In one word: quagmire. I said
it was `silly, useless, and damaging'

1) this opens them up to having to do this *regularly*. Is this what
they want to be doing?

2) since when does EFF help federal BBS investigations?

3) M. Godwin just got done informing us the beauty of *non* liability
with a hands-off BBS operator policy.

4) its silly to post a notice about given filenames. They simply are as
amorphous as cyberspace itself.

5) a recall of any type is a notorious way to generate paranoia,
perhaps a cure worse than the affliction. this kind of message spreads
like wildfire. `What? EFF says file [x] is child pornography?' There
are tens of thousands of BBS operators in the U.S. -- is this a service
or a disservice to them? hence my urban myth ramblings.

6) Releasing this kind of notice only draws more attention to those
files. Suddenly, they become collectors items. People start hunting
them down. People create empty files with the same name as a joke. All
because `EFF says file [x] is child pornography'

7) many other reasons that will become obvious and important in
retrospect, but look like hypersensitivity at this point.

* * *

I'm very upset that

1) everybody on the list is hiding, and refuses to criticize EFF
despite the strong parallels to CERT. at best this is cowardice and at
worst hypocrisy. this tiptoeing and silence is very reprehensible, IMHO.

2) it does not appear to me that EFF has thought this through. this
announcement reflects on EFF. why couldn't they have phrased it
differently? e.g. Agents [x] of government agency [x] have requested
that operators remove these files. As it stands, EFF associates its own
reputation with this investigation and the file recall.

3) there have been requests from EFF representatives to `let it drop'.
well, yes, that is one way of dealing with the issue, but IMHO more
appropriate to a species of animal called `ostriches'.

4) in general, I object to this philosophy found elsewhere on the list
of `if its in our backyard then don't criticize it'. the Fidonet
operators are like this. EFF is like this. The former, in their
cryptophobia and surveillance, are implicitly supportive of the
philosophy of Clipper and the NSA. The latter, EFF, has a critical role
in promoting coolness, not hysteria, among BBS operators.

5) In a rather low blow, S. Steele writes ``I figured those who sought
to challenge the child pornography laws would poo poo the message.  I
guess I figured right.'' For the record, I do not seek to challenge
child pornography laws or federal investigations. My message made
rather clear that I was objecting to the role of *EFF* in the affair.

* * *

Lastly, I guess I'm a little confused.

tcmay@netcom.com (Timothy C. May)
>No, I won't say it was silly, useless, or damaging.
>[...]
>Do I hear any volunteers to become a test case?

I tweaked T.C. May in the hope of seeing a message analyzing child
pornography in digitized images over cyberspace, because I thought I
recall him writing a rather amazing essay on the subject some months
ago on the list. Apparently, based on my recent private email exchange,
he wasn't associated with that. I guess I just misremembered because it
seemed like such a classic cypherpunkesque rant in the spirit of his best.

Anyway, as I recall, *someone* about 3 or 4 months ago posted to the
list a remarkable analysis of a brouhaha surrounding the creation of
the group `alt.pictures.erotica.children'. The person talked about
posting a PGP file to the group, as I recall with an anonymous
remailer, and then talked about the fierce reaction (melee?) involved.
The person stated that the group appeared to have been created as a
joke, and the file itself as PGP code was actually not legal syntax for
`plausible deniability' of the author, but nevertheless raised important questions.

The essay talked about the fruitlessness of trying to track down actual
`child pornography' over cyberspace. One of the main points was that
child pornography is not illegal everywhere, as I recall the person
mentioned Denmark as a place where it particularly flourishes. Is a GIF
illegal if it was taken in a country that prohibits it? that's easy.
But what about if it was taken in a country where it was legal and
imported? well, in the U.S. this is illegal too.

But the poster raised a lot of other very fascinating questions that
were highly relevant to pornography in cyberspace. Digital composition
tools allow artist to cut and paste pictures with astonishing realism.
What about a situation where adult models (as young as possible) are
used and child's faces are plastered on top? Or how about the situation
where *entirely imaginary pictures* are created? These are very real
possibilities. Are they illegal too? How is it that just a particular
configuration of pixels constitutes illegal pornography, and another
does not? I think the poster made various humorous remarks about baby
pictures too -- the type of children on bearskin rugs. Shall we
imprison all parents that have taken these? (ug, I can't wait for all
silly flames on the `I know it when I see it' definition of pornography.)

This was my point with the EFF warning: the whole area is a quagmire,
and the only consistent and enforceable philosophy seems to be a `hands
off' approach. It is very likely to evolve in the long-term future
because of all the quandaries. And in particular I was hoping the essay
would pop up again on the list so they could see that perspective.

Anyway, the poster then made some characteristic comments about the
changes that cyberspace will introduce to these kind of pornography
laws. The whole essay was such a brilliant exercise, IMHO, and involved
actual `research' and `analysis', that I guess I just sort of
misremembered T.C. May writing it, but apparently this is not the case.
Anyway, I apologize for the misattribution. Just `attribute the
misattribution' to my degenerating memory for specifics after 35
hundred cypherpunk postings <g>

(But I would be fascinated to see that essay again, if anyone has a
clue of what I'm talking about. Hopefully the writer is still on the
list, has it in archives, and can post it. It's highly germane to the
EFF warning, and was a really brilliant cypherpunk document, IMHO. If
I'm just hallucinating over the whole thing, well, maybe its time for
me to unsubscribe <g> )

Lance writes:

> 1) this opens them up to having to do this *regularly*. Is this what
> they want to be doing?
 
I doubt that EFF is regularly going to have a list of graphics files that
the feds are using as the basis of a child-porn investigation.

> 2) since when does EFF help federal BBS investigations?
 
I don't see how letting people know what the feds are looking for is
"helping" the feds.

> 3) M. Godwin just got done informing us the beauty of *non* liability
> with a hands-off BBS operator policy.
 
In particular, I've been talking about noninterference with electronic
mail. But look at our choices, Lance. The alternative, when we knew what
files were being looked for, was *not to let anyone know*. It strikes me
as difficult, ethically, to justify *not* letting people know what
particular files are being looked for.

The issue of letting people know about these files is logically separate
from the issue of whether a sysop will be held legally liable for files he
or she doesn't know about.

> 4) its silly to post a notice about given filenames. They simply are as
> amorphous as cyberspace itself.

Not quite. In real life, those who traffic in GIFs normally deal in such a
volume of files that they rarely trouble to change their names.

> 5) a recall of any type is a notorious way to generate paranoia,
> perhaps a cure worse than the affliction. this kind of message spreads
> like wildfire. `What? EFF says file [x] is child pornography?' There
> are tens of thousands of BBS operators in the U.S. -- is this a service
> or a disservice to them? hence my urban myth ramblings.
 
Sometimes telling the truth *does* generate paranoia. Look, it is
difficult for me to justify *not* giving sysops information that a *lot*
of sysops (although perhaps not you, Lance) would very much like to have.
What's more, a sysop can determine whether he's had files with these names
uploaded to his system *without snooping through someone's e-mail*.

Tell you what, Lance: if you can find a number of sysops who would *rather
not know* the kind of information that Shari disclosed in her message, we
will weigh their reluctance to know carefully if this situation should
ever come up again.

> 6) Releasing this kind of notice only draws more attention to those
> files. Suddenly, they become collectors items. People start hunting
> them down. People create empty files with the same name as a joke. All
> because `EFF says file [x] is child pornography'
 
I think I'll wait until I see this actually happen before I regard it as a
serious possibility.
> 2) it does not appear to me that EFF has thought this through. this
> announcement reflects on EFF. why couldn't they have phrased it
> differently? e.g. Agents [x] of government agency [x] have requested
> that operators remove these files. As it stands, EFF associates its own
> reputation with this investigation and the file recall.
 
If what you are doing here is criticizing the *wording* of the
announcement, that undercuts your other comments here. You seem to be
saying it would be *okay* to release the list of graphics files if we had
written the announcement differently.

If that is the substance of your criticism, fine. Send us a redrafted
announcement--the way you think it should be written. 

> 4) in general, I object to this philosophy found elsewhere on the list
> of `if its in our backyard then don't criticize it'. 

Personally, I don't mind your taking the trouble to criticize EFF over
this. But I hope you understand us well enough to realize that reasonable
people can disagree over this issue. Again, it strikes me as hard to
justify *not* giving sysops the info that at least *some* of them would
want.

> 5) In a rather low blow, S. Steele writes ``I figured those who sought
> to challenge the child pornography laws would poo poo the message.  I
> guess I figured right.'' For the record, I do not seek to challenge
> child pornography laws or federal investigations. My message made
> rather clear that I was objecting to the role of *EFF* in the affair.
 
Lance, I personally don't think your criticisms here imply any opposition
to the child-porn laws.

For all that you may be write that "the whole area is a quagmire," it
seems important to stress that EFF wasn't dealing with "the whole
area"--only with the particular issue of whether to let people know what
we had discovered about a particular federal investigation.

We were trying to be helpful. If it's your position that publishing that
list of files was *wholly unhelpful*, that it will turn out to have been a
mistake, well, perhaps you're right. But I don't think our action here is
so obviously wrong in the black-and-white way you seem to be implying
here.


--Mike

As a quickie preface, I state that I feel no guilt posting this to
cypherpunks, even in light of the many recent complaints about
bandwidth.  This issue seems quite germaine to me, though it's
only tangentially related to cryptography.

"L. Detweiler" writes:
 > I posted the announcement to the cypherpunks because
 > 
 > 2) there was a huge flame war over CERT sending a notice to E.Hughes
 > for his FTP site, saying `please look into this'-- this EFF
 > announcement struck me as amazingly similar.

It doesn't strike me as similar at all.  One was a specifically
targeted notice, and the other was a broadcast for general
consumption.

 > Now, why did I flame EFF for this action? In one word: quagmire. 

You flamed because "quagmire"?  What does that mean?  (I know what
"quagmire" means; I can't parse the sentence "I flamed the EFF because
quagmire.")

 > I said it was `silly, useless, and damaging'

Silly?  Seemed pretty serious to me.  Useless?  Well, it was
dissemination of pertinent information; given the signal to noise
ratio of the electronic infonet world, that's saying a lot.  Damaging?
Well, that's the debatable point.

 > 1) this opens them up to having to do this *regularly*. Is this what
 > they want to be doing?

I don't agree with this, though it may be true that such expectations
will be established.  (After this uproar, I doubt it.)

 > 2) since when does EFF help federal BBS investigations?

Help?!?  Was the EFF passing along names of suspect BBSes?  Indeed,
I'd say they were *hindering* the investigation, if anything; they're
suggesting that "evidence" be destroyed.

 > 3) M. Godwin just got done informing us the beauty of *non* liability
 > with a hands-off BBS operator policy.

There's a BIG difference between non-liability and immunity from
seizure.

 > 4) its silly to post a notice about given filenames. They simply are as
 > amorphous as cyberspace itself.

Is it really silly?  Though I'll of course agree that the names
*could* be changed, are they?  How common is that?  Isn't it probably
true that if those files exist somewhere it's highly likely that they
have those names?  If so, is it still "silly" to publish the names?

(Is it "silly" for "Wanted" posters to contain photos and descriptions
of hair length, facial hair, body weight, and so on, given that such
things can easily be changed?)

 > 5) a recall of any type is a notorious way to generate paranoia...

I don't think that EFF would claim to have the power of "recall".

 > `What? EFF says file [x] is child pornography?'

No, EFF says file X is a hot topic in some particular investigation of
child pronography being conducted by some law enforcement
organization.  It's a statement of fact.

 > 6) Releasing this kind of notice only draws more attention to those
 > files. Suddenly, they become collectors items. People start hunting
 > them down. People create empty files with the same name as a joke. All
 > because `EFF says file [x] is child pornography'

I don't see why this should be an argument against posting the
warning.  Hurricane warnings generally bring many people who want to
surf or just look aat and experience the hurricane; would it be better
to just keep a lid on the whole tropical depression thing?

 > 7) many other reasons that will become obvious and important in
 > retrospect, but look like hypersensitivity at this point.

My breath is held.

 > I'm very upset that
 > 
 > 1) everybody on the list is hiding, and refuses to criticize EFF
 > despite the strong parallels to CERT. at best this is cowardice and at
 > worst hypocrisy. this tiptoeing and silence is very reprehensible, IMHO.

Whoa, podner.  Speak for yourself.  You're giving us (a) cowardice or
(b) hypocrisy; why not (c) a difference of opinion with L Detweiler?

 > 2) it does not appear to me that EFF has thought this through. this
 > announcement reflects on EFF. why couldn't they have phrased it
 > differently? e.g. Agents [x] of government agency [x] have requested
 > that operators remove these files. As it stands, EFF associates its own
 > reputation with this investigation and the file recall.

I can't argue with this; the fact of this conversation proves your
point.

 > 3) there have been requests from EFF representatives to `let it drop'.
 > well, yes, that is one way of dealing with the issue, but IMHO more
 > appropriate to a species of animal called `ostriches'.

I also agree with this: the subject bears discussion.  I think it's
relevant to cypherpunks because the topic could someday be "files
foo.X and bar.X are suspected of being encrypted Top Secret Stuff, and
are being sought in an investigation of pirate cryptography".

--
Mike McNally