Re: San Jose Merc article on s/w industry crypto deal

> HIGH-TECH FIRMS WON'T OPPOSE DATA-SCRAMBLING CHIP 
> 
>   THEY'LL ACCEPT 'CLIPPER' PROPOSAL IF U.S. WILL EASE SOFTWARE EXPORT RULES.
> 
> By LEE GOMES 
> Mercury News Staff Writer
> 
> With some privacy advocates crying foul, a group of prominent high-tech
> companies is dropping its opposition to a controversial White House proposal
> for a new data-scrambling chip in exchange for a relaxing of the federal
> rules restricting the export of scrambling software.
> 
> The Digital Privacy and Security Group, a collection of computer companies
> and related associations, said Monday that it could accept the
> administration's ''Clipper'' chip proposal if the chip's adoption was
> voluntary, and if other encryption software were available for sale,
> especially overseas.

What a sell-out (literally).  Will these guys also support the government's
right to conduct random house-to-house searches if they're promised a piece
of the booty?  And Clipper has ALWAYS been "voluntary" (at least so far), so
that part of the deal is no victory at all.  With friends like these...

   --Dave.

If the government really were to commit to removing export controls on
all civilian cryptography, and to ensuring that Clipper remains truly
voluntary, then I could see how the DPSG compromise *might* have some
merit.  With or without such an agreement, Clipper is a non-starter --
as long as better alternatives are readily available.

This is already true for general purpose computers. People can easily
run whatever encryption software they like on their PCs, whether the
NSA, FBI or anyone else likes it or not. Unfortunately, it is NOT true
for voice services like digital cellular. Although they contain
computers, digital phones are not as easily reprogrammed as PCs. And
even if they were, you still need the cooperation of the carrier to
decrypt your call at the base station (unless, of course, you encrypt
end-to-end, but then you need the right kind of data service from the
carrier, plus a compatible secure telephone on the land side of the
call).

In theory, at least, under this "deal" the cellular vendors would be
free to support either Clipper or some other, better encryption
scheme, without fear of export controls destroying much of their
market.

In reality, of course, the cellular carriers and manufacturers are
large and conservative enough (and do enough business with the
government) to be easily browbeaten into installing only Clipper, if
indeed they install any real encryption at all.  Indeed, the NSA
hardly had to lift a finger to browbeat the industry into installing a
trivial "voice privacy" scheme in TDMA cellular that can be broken by
any undergrad CS student in a few minutes.

So I'm not worried about the effect of this deal on general purpose
computer applications; it may even help, by getting rid of export
controls. But the big loser will inevitably be voice privacy.

Phil

[David Mandl] has written:
>
>> HIGH-TECH FIRMS WON'T OPPOSE DATA-SCRAMBLING CHIP 
>> 
>>   THEY'LL ACCEPT 'CLIPPER' PROPOSAL IF U.S. WILL EASE SOFTWARE EXPORT RULES.
>> 
>> By LEE GOMES 
>> Mercury News Staff Writer
>> 
>> With some privacy advocates crying foul, a group of prominent high-tech
>> companies is dropping its opposition to a controversial White House proposal
>> for a new data-scrambling chip in exchange for a relaxing of the federal
>> rules restricting the export of scrambling software.
>> 
>> The Digital Privacy and Security Group, a collection of computer companies
>> and related associations, said Monday that it could accept the
>> administration's ''Clipper'' chip proposal if the chip's adoption was
>> voluntary, and if other encryption software were available for sale,
>> especially overseas.
>
>What a sell-out (literally).  Will these guys also support the government's
>right to conduct random house-to-house searches if they're promised a piece
>of the booty?  And Clipper has ALWAYS been "voluntary" (at least so far), so
>that part of the deal is no victory at all.  With friends like these...
>
>   --Dave.
>

That's a really _REALLY_ good point.  I mean, a weak government encryption
standard (like um . . . DES) is basically no different than abolishing the
Fourth Ammendment.  Right?  Right?  Right . . .