PGP in FIDO

* Reply to msg originally in CYPHERPUNKS

 > My question is this: how does he know that the mail is encrypted if he's
 > not examining the mail that passes through his system? If he *is*
 > examining the mail that passes through his system, it seems likely that he
 > is violating the Electronic Communications Privacy Act.

In that FIDOnet mail points (or individual BBSs) are not required to
pass or accept encrypted FIDO traffic under FIDOnet rules, some run a
specific program that scans for the "PGP MESSAGE" string and bumps it to
a SECURENET mail hub (or, in some cases, _kills_ it).  It is not done by
individual, personal inspection - at least not at mail hub level.

Anyway, the ECPA is basically irrelevant in the BBS world, as 1] almost
every BBS states at log-on that there is no such thing as truly
"private" e-mail on the system as the sysop can, will and does see
messages in all areas, and 2] he is personally _liable_ for any illegal
activity on his BBS, so he can reasonably be expected to keep an eye on
e-mail for anything that will put his ass in a sling.

There has been a very heated war in FIDOland over PGP and other
encryption.  Considering the risk that sysops take on by permitting
secure (?) communication on their BBSs, I must say I admire their
courage when they allow it and participate on SECURENET.  Personally,
_I_ would never stick my neck out like that, though I convinced many
FIDOnet BBSs to do so for my own political and purely selfish reasons.

BTW, this message comes via FIDOnet and was originally PGP encrypted for
the remailer, and the cypherpunks@toad.com mailing is converted to a
conference on a FIDO BBS where I read the message to which I am
responding.

anonymous@extropia.wimsey.com writes:
 > Anyway, the ECPA is basically irrelevant in the BBS world, as 1] almost
 > every BBS states at log-on that there is no such thing as truly
 > "private" e-mail on the system as the sysop can, will and does see
 > messages in all areas, and 2] he is personally _liable_ for any illegal
 > activity on his BBS, so he can reasonably be expected to keep an eye on
 > e-mail for anything that will put his ass in a sling.

Ok, this is really getting bizarre.  Why is it so hard to accept that
the ECPA---federal law of the land---applies to BBS operators in the
United States?  It may be a pain in the butt, and it may be an insult
to the noble souls who operate FIDOnet nodes out of the goodness of
their hearts, but that's Life In The Big City.

Perhaps some of the confusion stems from ignorance on my (and,
perhaps, other Internet weenies') part about the topology and
operation of FIDOnet.  As I understand it, ECPA applies if private
third party communications are routed through some FIDOnet agent.
Does this ever happen?

--
Mike McNally

>> Anyway, the ECPA is basically irrelevant in the BBS world, as ....

I'm truly amazed.  Mike Godwin, who is a lawyer who *specializes* in
this sort of thing, has rebuffed this statement several times, and
given his phone number for interested BBS sysops to call him.   And
yet, people continue to spew disbelief.

Of course, without real case law, Mike's opinion is still just that,
but when some BBS sysop gets nailed by the ECPA, I'm gonna laugh.

		Marc

Marc Horowitz says:
> >> Anyway, the ECPA is basically irrelevant in the BBS world, as ....
> 
> I'm truly amazed.  Mike Godwin, who is a lawyer who *specializes* in
> this sort of thing, has rebuffed this statement several times, and
> given his phone number for interested BBS sysops to call him.   And
> yet, people continue to spew disbelief.
> 
> Of course, without real case law, Mike's opinion is still just that,
> but when some BBS sysop gets nailed by the ECPA, I'm gonna laugh.

I have half a mind to get a FIDO account, try to send a message the
sysop doesn't understand so he'll stop it, and then call the U.S.
Attorney's office.

Actually, I wouldn't ever do that -- my libertarian ethics stop me,
since there is no real contract to get private mail between me and the
operator, never mind how stupid what is is doing is. However, the law
is the law. Disagreeing with it or consciously deciding to violate it
is one thing, but smug amateur lawyering in which you pretend that it
isn't supposed to apply to you is another.

Perry

However, the law
   is the law. 

And as such is an ass, yes.

   Disagreeing with it or consciously deciding to violate it
   is one thing, but smug amateur lawyering in which you pretend that it
   isn't supposed to apply to you is another.

I don't see the good in this sort of thing.  The FIDOnet operators
in question are probably operating in good faith, whether mistakenly
or no, their smugness or lack thereof is not in evidence, and if there
is anyone you should be annoyed with, it is the federal agencies which
have created such a chilling atmosphere that their belief resulted.
Put another way, they're terrified of the feds.  Terrified people make 
stupid mistakes.  The root of the problem is the cause of the
terror, not the mistakes that result.  

I think it would be more constructive, instead of trying to imprison
the BBS operator for offending your aethetic judgement (I realize you
were not serious, of course -- please accept my rhetorical license as 
no less broad than your own), to document to them the reasoned legal
opinion of the appropriately credentialled M. Godwin, so that they may
protect themselves from legal assault.

Marc writes:

> I'm truly amazed.  Mike Godwin, who is a lawyer who *specializes* in
> this sort of thing, has rebuffed this statement several times, and
> given his phone number for interested BBS sysops to call him.   And
> yet, people continue to spew disbelief.

One reason I gave out my number is to allow people to ask me specific
questions that refer to how they run their *specific* systems--it may be
that they're not risking ECPA liability, given the particular conditions
they're working under. 

But one think I think sysops need to realize is that ECPA is the *default*
setting.
 
> Of course, without real case law, Mike's opinion is still just that,
> but when some BBS sysop gets nailed by the ECPA, I'm gonna laugh.

On some of my interpretations of ECPA, reasonable lawyers may disagree,
but at this point most FIDO sysops who assert that ECPA doesn't apply
haven't read the statute.


--Mike

> I'm truly amazed.  Mike Godwin, who is a lawyer who *specializes* in
> this sort of thing, has rebuffed this statement several times, and
> given his phone number for interested BBS sysops to call him.   And
> yet, people continue to spew disbelief.
> 
> Of course, without real case law, Mike's opinion is still just that,
> but when some BBS sysop gets nailed by the ECPA, I'm gonna laugh.

Could someone post the relevent parts of this?  I'd like to upload this
to several BBS's out here...
-- 
Ed Carp, N7EKG			erc@apple.com			510/659-9560
                            an38299@anon.penet.fi
If you want magic, let go of your armor.  Magic is so much stronger than
steel!        -- Richard Bach, "The Bridge Across Forever"

On Sat, 2 Oct 1993, Marc Horowitz wrote:

> >> Anyway, the ECPA is basically irrelevant in the BBS world, as ....
> 
> I'm truly amazed.  Mike Godwin, who is a lawyer who *specializes* in
> this sort of thing, has rebuffed this statement several times, and
> given his phone number for interested BBS sysops to call him.   And
> yet, people continue to spew disbelief.
> 
> Of course, without real case law, Mike's opinion is still just that,
> but when some BBS sysop gets nailed by the ECPA, I'm gonna laugh.

 Hasn't happened yet and the ECPA was passed in what? 1986? I really doubt
if a BBS sysop is going to get nailed over someone's view of e-mail on
their system.

Al Billings writes:

>  Hasn't happened yet and the ECPA was passed in what? 1986? I really doubt
> if a BBS sysop is going to get nailed over someone's view of e-mail on
> their system.

There's a new consciousness of ECPA thanks in part to the efforts of EFF
and to Steve Jackson's successful ECPA case.

But, Al, the issue is less whether a particular sysop is going to be
prosecuted under ECPA than it is whether that sysop's conduct is *both*
legal and ethical.

Even if a sysop's policies fit within ECPA exceptions, it's dishonest to
justify such policies in terms of risks that don't exist. There is no
documented risk that a sysop will be at greater legal liability if he or
she allows encrypted mail.


--Mike

On Sun, 3 Oct 1993, Mike Godwin wrote:

> But, Al, the issue is less whether a particular sysop is going to be
> prosecuted under ECPA than it is whether that sysop's conduct is *both*
> legal and ethical.
> 
> Even if a sysop's policies fit within ECPA exceptions, it's dishonest to
> justify such policies in terms of risks that don't exist. There is no
> documented risk that a sysop will be at greater legal liability if he or
> she allows encrypted mail.

True and if I had netmail set up for my system, I would probably allow
encrypted netmail. I already offer the latest version of PGP (source and
executable) to my users. The sysop ultimately has the right to choose if
he or she allows encrypted mail on his or her system. After all, the sysop
owns the machine and pays the bills, especially since most Fidonet sites
are hobby sites with no fees for access.

Wassail,
Al Billings

anonymous@extropia.wimsey.com says:
> Anyway, the ECPA is basically irrelevant in the BBS world, as 1] almost
> every BBS states at log-on that there is no such thing as truly
> "private" e-mail on the system as the sysop can, will and does see
> messages in all areas, and 2] he is personally _liable_ for any illegal
> activity on his BBS, so he can reasonably be expected to keep an eye on
> e-mail for anything that will put his ass in a sling.

You haven't been listening at all to Mr. Godwin, have you?

1) The ECPA *DOES* apply to the BBSes whether they want it to or not.
   All the hoping in the world doesn't make a statute go away. Merely
   declaring that the ECPA doesn't apply to you doesn't work -- try
   declaring the tax laws don't apply to you some time and see if that
   works.
2) The BBS operators are NOT liable UNLESS they censor the mail. If
   they censor the mail, they are liable for anything they fail to
   censor. If they do not censor, they are common carriers, and have
   no liability.

In other words, jackasses pretending they understand the law have both
broken the law and made themselves more, not less, liable for anthing
left on their machines.

> There has been a very heated war in FIDOland over PGP and other
> encryption.  Considering the risk that sysops take on by permitting
> secure (?) communication on their BBSs,

They take NO risk. They are common carriers if they stop censoring
their mail. People don't seem to understand that the law on this is
very clear.

By the idiotic logic the FIDO operators are using, the phone company
could be siezed if two people have a conversation about a crime over
the phone. The notion is, of course, absurd, and so is the stupid
half-assed amateur lawyering the people who wrote the FIDO policies
used.

> Personally, _I_ would never stick my neck out like that, though I
> convinced many FIDOnet BBSs to do so for my own political and purely
> selfish reasons.

Actually, as I've just noted, you have not protected yourself. You
have opened yourself up for massive legal liability where you had none
before.

The depths of human folly never cease to amaze me. This case is as if
a group of bankers, deciding that they were scared that they might be
held liable if one of their clients were a drug dealer (which they
aren't) decides to embezzle all the client accounts instead to "keep
themselves safe".

Perry

Perry E. Metzger wrote:

# They take NO risk. They are common carriers if they stop censoring
# their mail.

Not long after I moved here, I had a discussion with a local lawyer on common
carrier status.  Take my recollections for what they're worth after three years
rattling around in the head of a non-attorney.
One doesn't become a common carrier by virtue of personal policy.  It's a
label that must be applied for with the local communications regulatory
authority (public utilities commission or what have you.)  You must publish
a tariff of your rate structure and other operating information.  There's
probably a lot more to do, but what it comes down to is paperwork, paperwork,
paperwork, and (depending upon the lawyer) no small amount of legal time and
expense.
What I also heard that day was that this particular lawyer, who was obviously
familiar with the process of consideration for common carrier status, would be
unable to submit an application because of a conflict of interest his company
would have.  They represent the local telephone company, which had then, and
still has now (in an unimpressive way,) an interest in getting into information
services.  I didn't make an exhaustive search for legal representation then,
but I could imagine it taking a real expedition to find somebody that wasn't
soaking up *some* of the money/influence that SWBT throws around in town (this
being the state capitol.)

[ Insert what Mike Godwin says next here.  :-) ]

Bob
--
 ==============================================================================
   Bob Izenberg                                     voice phone: 512-891-8680
   Motorola RISC Software                               bobi@vswr.sps.mot.com
 ==============================================================================

Perry> Mike Godwin will have to confirm this, but to my knowledge Common
Perry> Carrier is NOT a status you have to apply for. UUNET operates as a
Perry> common carrier and has never registered with anyone.

Interesting assertion. I suspect that you could say the same of any
other regional IP provider. A lot of service providers leap to claim the
appelation "common carrier", in the hope that it will absolve them of
responsibility for their users' actions. In the real world, most
providers, including UUNET and PSI, make their customers sign
agreements that said customers won't use the networks for nefarious
ends. Note that the phone company doesn't do this. 

It'll be a while (and a few court cases) before I have any confidence
that the U.S. Gov't recognizes IP service providers as common carriers
in any real sense. 

--strat

NOTE: I don't speak for anyone but little old me, besides it's
only my 2nd week here. :-)


Bob Stratton					strat@uunet.uu.net
UUNET Technologies, Inc.			uunet!strat
3110 Fairview Park Dr., Suite 570		Voice) +1 703 204 8000
Falls Church, Va 22042				Fax)   +1 703 204 8001

Bob Izenberg says:
> Perry E. Metzger wrote:
> 
> # They take NO risk. They are common carriers if they stop censoring
> # their mail.
> 
> Not long after I moved here, I had a discussion with a local lawyer
> on common carrier status.  Take my recollections for what they're
> worth after three years rattling around in the head of a
> non-attorney.  One doesn't become a common carrier by virtue of
> personal policy.  It's a label that must be applied for with the
> local communications regulatory authority (public utilities
> commission or what have you.) 

Mike Godwin will have to confirm this, but to my knowledge Common
Carrier is NOT a status you have to apply for. UUNET operates as a
common carrier and has never registered with anyone.

Perry

Perry E. Metzger wrote:

# Mike Godwin will have to confirm this, but to my knowledge Common
# Carrier is NOT a status you have to apply for. UUNET operates as a
# common carrier and has never registered with anyone.

Well, we won't really know until the legal beagles deliver their opinions
(and perhaps not even then, if they disagree.)  What I wonder is, what does
the phrase "operates as a common carrier" mean?  Who has to grant you that
status before it has any meaning as a legal protection?

Bob
--
 ==============================================================================
   Bob Izenberg                                     voice phone: 512-891-8680
   Motorola RISC Software                               bobi@vswr.sps.mot.com
 ==============================================================================

Bob Izenberg says:
> Perry E. Metzger wrote:
> 
> # Mike Godwin will have to confirm this, but to my knowledge Common
> # Carrier is NOT a status you have to apply for. UUNET operates as a
> # common carrier and has never registered with anyone.
> 
> Well, we won't really know until the legal beagles deliver their opinions
> (and perhaps not even then, if they disagree.)  What I wonder is, what does
> the phrase "operates as a common carrier" mean?  Who has to grant you that
> status before it has any meaning as a legal protection?

Many sorts of status do not require that anyone GRANT you anything.
Lets say, for example, that you live in state that permits common law
marriage. In such a state, it is sufficient to think of yourself and
your S.O. as married, and behave in that manner -- at that point you
legally are married. (Note that common law marriages are now only
possible in a few state -- 9 I believe.)

As for what "common carrier" means, it means that the law recognizes
that you are a carrier of things, not a creator of them, and that you
are not responsible for what you carry. That means that the phone
company can transmit as many criminal phone conversations as it likes
without having its switches siezed.

In order to be a common carrier, you have to transmit all the messages
you receive without differentiating between them, paying attention to
what they are, or censoring them.

Perry

> Many sorts of status do not require that anyone GRANT you anything.
> Lets say, for example, that you live in state that permits common law
> marriage. In such a state, it is sufficient to think of yourself and
> your S.O. as married, and behave in that manner -- at that point you
> legally are married. (Note that common law marriages are now only
> possible in a few state -- 9 I believe.)

FYI, to be married in this way, you have to declare yourself in public as
married - introducing yourself as someone's husband or wife, for example, is
enough.  But being "common law" married, it's only "legally" - that is, if
one or both parties want to dissolve the marriage and don't want to exercise
their rights, they can just walk away from the marriage.

Texas is such a state.
-- 
Ed Carp, N7EKG			erc@apple.com			510/659-9560
                            an38299@anon.penet.fi
If you want magic, let go of your armor.  Magic is so much stronger than
steel!        -- Richard Bach, "The Bridge Across Forever"

Ed Carp says:
> FYI, to be married in this way, you have to declare yourself in public as
> married - introducing yourself as someone's husband or wife, for example, is
> enough.  But being "common law" married, it's only "legally" - that is, if
> one or both parties want to dissolve the marriage and don't want to exercise
> their rights, they can just walk away from the marriage.

Untrue. Common law marriage is a real marriage in every single sense.
There is no legal difference in states that recognize it. You need a
real honest to god divorce in order to end one. Look it up if you
don't believe me.

Perry

> Ed Carp says:
> > FYI, to be married in this way, you have to declare yourself in public as
> > married - introducing yourself as someone's husband or wife, for example, is
> > enough.  But being "common law" married, it's only "legally" - that is, if
> > one or both parties want to dissolve the marriage and don't want to exercise
> > their rights, they can just walk away from the marriage.
> 
> Untrue. Common law marriage is a real marriage in every single sense.
> There is no legal difference in states that recognize it. You need a
> real honest to god divorce in order to end one. Look it up if you
> don't believe me.

Not at all.  I *did* look it up.  Technically, you are correct - but that
marriage is recorded by no government agency, you won't find it in any
public records - hell, if you still file 'single' on your tax return, who's
going to know?  You can just walk away - and if your spouse agrees with
you, you *can*.  I'm not talking about 'what would do in court' - I'm
talking real life.

How do I know?  I'm an ex-cop.  I worked on one of those 'common law'
marriage cases.
-- 
Ed Carp, N7EKG			erc@apple.com			510/659-9560
                            an38299@anon.penet.fi
If you want magic, let go of your armor.  Magic is so much stronger than
steel!        -- Richard Bach, "The Bridge Across Forever"

Ed Carp says:
> > Untrue. Common law marriage is a real marriage in every single sense.
> > There is no legal difference in states that recognize it. You need a
> > real honest to god divorce in order to end one. Look it up if you
> > don't believe me.
> 
> Not at all.  I *did* look it up.  Technically, you are correct - but that
> marriage is recorded by no government agency, you won't find it in any
> public records - hell, if you still file 'single' on your tax return, who's
> going to know?

If you still file "single" on your tax returns, you haven't met the
common law standard of acting in every way as if you were married.

> You can just walk away - and if your spouse agrees with
> you, you *can*.  I'm not talking about 'what would do in court' - I'm
> talking real life.

This is true even of normal marriages. If you and your spouse simply
agreed never to make an issue of it, you could walk away and no one
would ever know.

I fail to see what your point is, but in any case this is NOT the
mailing list for discussing this topic.

Perry

Perry E. Metzger wrote:

# As for what "common carrier" means, it means that the law recognizes
# that you are a carrier of things, not a creator of them, and that you
# are not responsible for what you carry.

I've got that part, but what needs to be done / provided before the
benefits of being a common carrier can be claimed?

Bob
--
 ==============================================================================
   Bob Izenberg                                     voice phone: 512-891-8680
   Motorola RISC Software                               bobi@vswr.sps.mot.com
 ==============================================================================

Bob Izenberg says:
> Perry E. Metzger wrote:
> 
> # As for what "common carrier" means, it means that the law recognizes
> # that you are a carrier of things, not a creator of them, and that you
> # are not responsible for what you carry.
> 
> I've got that part, but what needs to be done / provided before the
> benefits of being a common carrier can be claimed?

I noted it in the rest of my message. You have to act like a utility
-- you do not discriminate between your customers, you do not read,
censor, or otherwise differentiate in the carriage of their mail. If
you behave like a utility, you become a common carrier. The law in
this regard is somewhat complicated, so I would consult an attorney if
I wanted to be sure about it.

I will point out, though, that even if you are not a common carrier
you have no liability for things you don't know about and don't
participate in. This is why, for instance, the maker of a knife can't
be arrested because the knife is used to kill someone instead of
cutting bread. The law is actually reasonable.

However, if you partially censor the mail going through your system,
not only are you liable for ECPA violations, but you become liable for
the content of the mail. Why? Because you are now taking
responsibility for stopping things from going through, and should you
fail to stop something from going through that is now a conscious
decision on your part for which you have liability.

Perry

In my opinion, few if any BBSs qualify as common carriers. Common carriers
hold themselves out as accepting all goods or passengers (or, in the case
of communications, all messages) indifferently. I know of no sysop who
operates under such a policy, or who would want to. 

uunet, in contrast, probably does qualify as a common carrier.

My discussions of legal liability are not grounded in common-carrier law
(in which I'm not yet an expert) but in criminal law and tort law.


--Mike

Perry writes:

> 1) The ECPA *DOES* apply to the BBSes whether they want it to or not.
>    All the hoping in the world doesn't make a statute go away. Merely
>    declaring that the ECPA doesn't apply to you doesn't work -- try
>    declaring the tax laws don't apply to you some time and see if that
>    works.

That said, it should be noted that sysops can contract with users for
users to waive their privacy rights under ECPA. But I think sysops should
do this *explicitly*, and should not justify doing so because of vague
perceptions of vaguely understood legal liability.

I also have to take exception to the statement by some people here that
sysops never allow private e-mail. I knew sysops who routinely did so when
I lived in Austin. But maybe Austin is more enlightened than the rest of
the country.

> 2) The BBS operators are NOT liable UNLESS they censor the mail. If
>    they censor the mail, they are liable for anything they fail to
>    censor. If they do not censor, they are common carriers, and have
>    no liability.
 
I wouldn't say this quite so strongly, but Perry has the gist of it right.
If you take on the duty of monitoring e-mail, you risk creating liability
for yourself if something problematic doesn't get censored. And the sysops
here generally admit that they don't real *all* e-mail.


--Mike

> By the idiotic logic the FIDO operators are using, the phone company
> could be siezed if two people have a conversation about a crime over
> the phone. The notion is, of course, absurd, and so is the stupid
> half-assed amateur lawyering the people who wrote the FIDO policies
> used.

You know, I wouldn't put it past some district attorneys to try... :( :(

If you use the phone to make a drug deal, well, bye-bye Pac Bell!!!  Hehehe...
-- 
Ed Carp, N7EKG			erc@apple.com			510/659-9560
                            an38299@anon.penet.fi
If you want magic, let go of your armor.  Magic is so much stronger than
steel!        -- Richard Bach, "The Bridge Across Forever"

anonymous writes:

> In that FIDOnet mail points (or individual BBSs) are not required to
> pass or accept encrypted FIDO traffic under FIDOnet rules, some run a
> specific program that scans for the "PGP MESSAGE" string and bumps it to
> a SECURENET mail hub (or, in some cases, _kills_ it).  It is not done by
> individual, personal inspection - at least not at mail hub level.
 
Absent waiver by users, this may still be an ECPA violation.

> Anyway, the ECPA is basically irrelevant in the BBS world, as 1] almost
> every BBS states at log-on that there is no such thing as truly
> "private" e-mail on the system as the sysop can, will and does see
> messages in all areas, and 2] he is personally _liable_ for any illegal
> activity on his BBS, so he can reasonably be expected to keep an eye on
> e-mail for anything that will put his ass in a sling.
 
Item (1) is the relevant item--if users agree to waive their ECPA rights,
there's no legal problem, although there may be ethical ones.

As for (2), well, there's no legal theory that says that a sysop is liable
for for any illegal activity on his BBS. The criminal law, in general,
does not make people liable for the conduct of others in the absence of
knowledge of that conduct.

Please, please don't make assertions about criminal liability based on
FIDO mythology.

> There has been a very heated war in FIDOland over PGP and other
> encryption.  Considering the risk that sysops take on by permitting
> secure (?) communication on their BBSs, I must say I admire their
> courage when they allow it and participate on SECURENET.

When you refer to the risk they're taking, could you be precise? What
statistics do you have that support the statement that FIDO sysops are at
risk if they allow encrypted communications? To my knowledge as a lawyer
who works in this area, no sysop has been held liable for allowing
encrypted communications on his or system.

 

--Mike