Impact of Free Strong Crypto (Essay of sorts)

If the below is cut off by your mailer or mine, please drop me a note and 
I shall send you a complete copy.

-uni- (Dark)


-----BEGIN PGP SIGNED MESSAGE-----

Political Ramifications of Free Encryption Technology.


To me the Cypherpunks represent the drive to free technology from a 
regimented, collectivist, and centralized regulatory structure.  So deep 
does this inclination seem to run that even liberal programs that might 
extend the reach of high technology particularly communications and data 
storage or processing technologies, through social reform are looked at 
almost universally with distaste.  There is almost a disgust at the mere 
notion of Federal Government involvement in the development and 
distribution of technology.  (Reaction to Al Gore's programs are a 
demonstration of this attitude).  Some on the list would certainly 
disagree, feeling that government should take responsibility to promise 
equal access in the face of the amazing disparity selectively distributed 
technology would create, but I feel these are mere philosophical 
differences in methodology, and not major conflicts in goals.  In some ways 
this debate is so powerful and threatens to fill so much bandwidth that 
some Cypherpunks seem to resist any political content on the list.  
(Witness the many clashes about what the Cypherpunks list is really for, 
and whether political topics even have a place therein).  A treatment of 
the merits of Government involvement in distributional aspects of 
technology, or the level of regulation required or desired goes beyond the 
scope of this work.  I wish instead to focus on the likely institutional 
reaction to a Cypherpunk victory.  This necessarily requires a good deal of 
assumption on my part.  Probably also some assumptions that are likely to 
make as many people happy as upset.  I think the underlying analysis below 
is sound whatever the political persuasions of the reader.  That being said 
let it be known that I consider the following as a "Cypherpunk victory."

1.  Complete freedom of technology, particularly encryption technology, 
regulated only by market forces.  This implies the lack of import/export 
restrictions, and a complete absence of projects designed to limit 
technology, or to standardize it for nefarious ends like Clipper.

2.  A wide market of hardware and software products allowing, among other 
things, strong, transparent cryptography for voice, data, fax, cellular, 
and video communications.

3.  Active and profuse vendors of related applications of the above 
technologies, including among others, digital banking, and anonymous mail 
(in my use including video, voice, data, and true digital cash).

I think these are all possible (however likely or unlikely) within the next 
five years.

Many Cypherpunks will necessarily draw a "fall of modern government" effect 
from the above conditions.  Others will see the existence of a regulatory 
entity much lessened in importance and control than today.  Still others 
will predict little change at all.  Whatever your position, I think it is 
clear that government, like any entity, will seek to survive despite the 
above conditions.  I assume in my construct that the Federal Government has 
fought these points on all fronts (a safe bet in my view) but lost (a less 
likely scenario to me in the next five years).  Given these facts, how is 
government likely to adjust?  Surely not without a fight to survive even in 
the face of what many see as impending doom for revenue collection and law 
enforcement.

I have often commented that Cypherpunks see things about 6 months to 2 
years before the popular culture begins to catch the scents.  It is 
surprising to me then that the list (as far as I know) has been so stuck in 
the present with regard to the likely reaction to long term Cypherpunk 
goals.  Most political discussions deal either with the present Federal 
Government threat, (Clipper, Digitel, Information Superhighway) or with the 
long term promise of Cypherpunk technology, but not the future Federal 
Government response to said technology.  Partly I think this is 
attributable to the perception that the Federal Government is as much 
behind the times as popular culture.  Technically this is probably true on 
the whole.  (Dorthy Denning being short sighted enough to insist that law 
enforcement needs wiretap ability because they have always had such an 
ability.  Ms. Denning's similarly dense arguments based on statistics to 
the effect that since law enforcement has used wiretaps so often, they must 
be indispensable and thus must be preserved.  What Ms. Denning never 
mentions, either accidentally or with intent, are the alternatives).  But 
it is equally true that there is, or there appears to be, some foresight on 
the policy level as to the implications of the new technology on the long 
term.  (The Clipper proposal is either a entirely absent minded program 
which can never work because the goal really is a non-mandatory non-
regulatory standard creation, or it is an adept foot in the door coup.  A 
tour de force program in conjunction with Digitel, Information Highway, and 
NIST designed to preempt technology.)  So what if the Cypherpunks win?


How will the complete inability of law enforcement (Federal or Local) to 
conduct wiretaps impact collection?  Those who think that law enforcement 
will just have to go away might want to reconsider.  Instead I think that 
law enforcement will simply become much more intrusive as a response to the 
unavailability of easy interception via wiretapping.

Recently on the list it was pointed out that few if any serious ciphers 
have been cracked without a Human Intelligence component.  Indeed many of 
the later successes against the Enigma machines could be found in German 
operator laziness rather than pure analytical prowess.  One Signals 
Intelligence type mentioned that his job was made much easier by the 
propensity of the German communication officers he was responsible for to 
use obscenities for their Enigma keys.

Currently wiretaps are so popular not because they are indispensable but 
because a series of court decisions have made them the simplest, and 
cheapest method of Criminal Intelligence.  Cases like _Smith v. Maryland_, 
442 U.S. 735 (1979) have placed a fairly low burden on the law enforcement 
officials seeking to intercept telephone conversations, and almost no 
burden on those who wish to intercept call setup information.  It is no 
surprise then that they have become so frequently used in criminal 
investigation and are so often cited as well as jealously defended as 
critical.

Given the national anti-crime sentiment (even far left democrats seem to 
have given up on rehabilitation, and any astute politician who aspires to 
another term is terrified of being portrayed as soft on crime), the 
position that secure communications will solve the lack of oversight and 
intrusiveness of law enforcement conveniently ignores the constitutional 
"adjustments" that were made in the face of the national neurosis with the 
war on drugs.  Instead Federal and Local law enforcement will begin to rely 
on Human Intelligence as well as more intrusive site collection to work 
around the technologically intensive and prohibitively expensive Signals 
Intelligence in the new era.  Courts, tired of dismissing hundreds of 
otherwise legitimate looking cases, are likely to judicially erode the 
constitutional protections protecting citizens from search and seizure 
particularly with reference to an increased law enforcement reliance on 
more intrusive room surveillance equipment.  In the context of the Fourth 
Amendment's structure this becomes a particularly difficult problem.  The 
Exclusionary Rule provides for the rejection of evidence collected in 
violation of the Fourth Amendment (there is no effective civil remedy) but 
as many commentators have pointed out this is a particularly difficult 
thing for a judge to do.  Exclusionary Rule motions come in the context of 
a convicted criminal, who most often was fairly obviously guilty, but who 
would be released without the evidence in question.  Most of today's 
Exclusionary Rule law comes from drug cases as it became increasingly 
difficult in the late 1970's and early 1980's to overturn convictions where 
two kilograms of cocaine was discovered by a questionable search.  Will not 
this same judicial activism be used to expand law enforcement's freedom to 
use room bugs and other intrusive methodology in the face of the argument 
that wiretapping is impossible?  Similarly is it likely that law 
enforcement will begin to rely on Human Intelligence to a much greater 
extent.  Targeted political organizations will be infiltrated with a much 
greater degree of aggressiveness, perhaps even surpassing levels of the 
1960's.  Frustration in law enforcement inability to penetrate the more 
advanced criminal circles will probably result in very creative 
interpretation of the rules, if not an outright disregard for them, to 
secure convictions.

More alarming perhaps are the ramifications for banking transactions.  In 
the absence of an ability to monitor transactions electronically Human 
Intelligence will be forced to fill in the gaps, creating a great demand 
for informants within the banking and financial industries.  The SEC simply 
will be unable to function as it does today without electronic monitoring 
of transactions.  Instead brokerage firms, high profile investors and 
financial institutions are more likely to be attacked with Human 
Intelligence and informants, perhaps even outright theft of records.  The 
implications for even the moderate level investor are ominous.

Given the flexibility of constitutional interpretation demonstrated by the 
New Deal legislation, is it any mystery that the new law enforcement 
methodology will be supported by the courts, especially in the face of 
complete law enforcement breakdown?

The only real practical legal recourse would be a clarification to the 
courts by the legislature.  However, if the current anti-crime atmosphere 
endures it is highly unlikely that any legislator will go on record as a 
obstacle to law enforcement by checking the courts back.

The Cypherpunks must ask themselves how to address these issues, and 
recognize the potential political impact of high technology and the losing 
law enforcement battle to keep up.  Would a Cypherpunk victory merely be 
bypassed by a clever end run?  Is this a case of "Even when you win you 
lose"?


- -uni- (Dark)


-----BEGIN PGP SIGNATURE-----
Version: 2.6ui

iQCVAgUBLo96MhibHbaiMfO5AQGiJgP+L9QiTUrtJ7J3YbsQIFR8+ZzB9zgdZm3F
erm7bOstN9PzFJ2id5XI1vWeq1zK1/WGsd+r7F0uG0cDrolY1INlKdM+PACfgEfz
JAPsJeZRbWLEQolFeNT1Kzmo3EzAWiNRo1OBBfaPdnmEGJDHTWvQlrNF0gftr9WO
cTvYC2fGfHM=
=K3c4
-----END PGP SIGNATURE-----

-- 
073BB885A786F666 nemo repente fuit turpissimus - potestas scientiae in usu est
6E6D4506F6EDBC17 quaere verum ad infinitum, loquitur sub rosa    -    wichtig!

A good essay by Black Unicorn (whose physical ID, by the way, is
unknown to us, despite his reputation and digsig). Just when some of
you thought the list was becoming dormant...

(I'll try to respond only to a handful of points, eliding the rest.)

Black Unicorn wrote:

> To me the Cypherpunks represent the drive to free technology from a 
> regimented, collectivist, and centralized regulatory structure.  So deep 
> does this inclination seem to run that even liberal programs that might 
> extend the reach of high technology particularly communications and data 
> storage or processing technologies, through social reform are looked at 
> almost universally with distaste.  There is almost a disgust at the mere 

Yes, it's quite amazing to me that what might be called the
"libertarian agenda" is so little disputed here. To be sure, many are
unhappy with mentions of guns or the like, and protest, but the core
ideas of voluntary interactions are seldom challenged.

This may be a good lesson for the larger political community: on
matters of personal and economic privacy, even modern liberals don't
favor an expanded role for the state.

...
> is sound whatever the political persuasions of the reader.  That being said 
> let it be known that I consider the following as a "Cypherpunk victory."
> 
> 1.  Complete freedom of technology, particularly encryption technology, 
> regulated only by market forces.  This implies the lack of import/export 
> restrictions, and a complete absence of projects designed to limit 
> technology, or to standardize it for nefarious ends like Clipper.

I think we almost have this won. There are so many degrees of freedom,
so many ways to move data, that attempts to control data flow seem
doomed. We can't stop lobbying, of course. (The FBI had a comment that
if Digital Telephony is delayed by two years--and this was said (by
Kelleher, I think, though I don't feel like grepping through my
archives to find the exact quote...it may be in the FAQ) in early
1994--that this delay would make it "too expensive" to ever try it
again...monkeywrenching the EFF's Wiretap Bill seems like a good goal
to me.)

> 2.  A wide market of hardware and software products allowing, among other 
> things, strong, transparent cryptography for voice, data, fax, cellular, 
> and video communications.

This one I am less sanguine about. PGP is just too hard to
use--witness the incredible amount of time being consumed in debates
about it, about features, bugs, etc., and the difficulties in
integrating into ordinary work habits, for most people. Commercial
crypto is not moving very quickly.

> 3.  Active and profuse vendors of related applications of the above 
> technologies, including among others, digital banking, and anonymous mail 
> (in my use including video, voice, data, and true digital cash).
> 
> I think these are all possible (however likely or unlikely) within the next 
> five years.

I thought it would take 5 years, too. Back in 1988. Oh well. But by
1999, lots of time for change. And we may see a digital cash
application just "pop out of nowhere," just as VCRs did.

> likely scenario to me in the next five years).  Given these facts, how is 
> government likely to adjust?  Surely not without a fight to survive even in 
> the face of what many see as impending doom for revenue collection and law 
> enforcement.

By the way, I devoted a *lot* of space in my Cyphernomicon FAQ to
issues like this, including one section entitled "How will Crypto
Anarchy Be Fought?"

> I have often commented that Cypherpunks see things about 6 months to 2 
> years before the popular culture begins to catch the scents.  It is 
> surprising to me then that the list (as far as I know) has been so stuck in 
> the present with regard to the likely reaction to long term Cypherpunk 
> goals.  Most political discussions deal either with the present Federal 

Again, I think my FAQ has a suitably long term focus. Especially on
the implications of anonymous systems, digital cash, data havens,
etc., on societal systems. Lots of amazing implications. Some I no
doubt have wrong, but I don't think I'm mired in the present.

And I think we have indeed seen things coming before a lot of others
did. The latest such alert, by Carl Ellison, myself, and others, is
about "software key escrow," or what Carl dubs "GAK" (government
access to keys). I think SKE is the wave of future repression, worth
starting to fight now. The popular media is largely oblivious to it,
as usual.  (John Markoff, of the NY Times, is on top of it, more so
than most of us, and is waiting for the right time to do something on
this.)

> Government threat, (Clipper, Digitel, Information Superhighway) or with the 
> long term promise of Cypherpunk technology, but not the future Federal 
> Government response to said technology.  Partly I think this is 
> attributable to the perception that the Federal Government is as much 
> behind the times as popular culture.  Technically this is probably true on 
> the whole.  (Dorthy Denning being short sighted enough to insist that law 
> enforcement needs wiretap ability because they have always had such an 
> ability.  Ms. Denning's similarly dense arguments based on statistics to 
> the effect that since law enforcement has used wiretaps so often, they must 
> be indispensable and thus must be preserved.  What Ms. Denning never 
> mentions, either accidentally or with intent, are the alternatives).  But 
> it is equally true that there is, or there appears to be, some foresight on 

Dorothy Denning is deeply involved with SKE, working with Miles Schmid
of the NSA and the folks from Trusted Information Systems (according
to Whit Diffie, who saw a joint presentation by the bunch of them in
Karlsruhe, and their glee that the Micali escrow patent will likely be
overturned due to prior art in Europe).

> How will the complete inability of law enforcement (Federal or Local) to 
> conduct wiretaps impact collection?  Those who think that law enforcement 
> will just have to go away might want to reconsider.  Instead I think that 
> law enforcement will simply become much more intrusive as a response to the 
> unavailability of easy interception via wiretapping.

I don't think the state will fold up its tent and fade away (to mix
some metaphors). I think we'll see some "Wacos in cyberspace," some
invocations of the Four Horsemen of the Infocalypse (Terrorists,
Pedophiles, Money Launderers, and Pornographers), and some repressive
laws involving national ID cards, reporting of all economic
transactions on the Net, etc. Lots of things they can do.

Lots of people will be killed by the thrashings of the dying beast.

...
> war on drugs.  Instead Federal and Local law enforcement will begin to rely 
> on Human Intelligence as well as more intrusive site collection to work 
> around the technologically intensive and prohibitively expensive Signals 
> Intelligence in the new era.  Courts, tired of dismissing hundreds of 
> otherwise legitimate looking cases, are likely to judicially erode the 
> constitutional protections protecting citizens from search and seizure 
> particularly with reference to an increased law enforcement reliance on 
> more intrusive room surveillance equipment.  In the context of the Fourth 

I don't think HUMINT is too likely to increase, as it costs so damned
much to hire all those agents. 

I do think we'll see--and are already seeing--erosions of formerly
sacred rights. (Black U. and I are obviously addressing our comments
to mostly American issues. Your mileage may vary.) "Conspiracy"
is already a catch-all, and the plethora of laws that nearly everyone
is always breaking can be used to cut deals. A nation of cybernetic
Pavel Morozovs, all informing on our neighbors. (Ironically, this
erosion could _accelerate_ the shift to more secure systems, as even
average people fear being caught up in alleged crimes.)

> Amendment's structure this becomes a particularly difficult problem.  The 
> Exclusionary Rule provides for the rejection of evidence collected in 
> violation of the Fourth Amendment (there is no effective civil remedy) but 
> as many commentators have pointed out this is a particularly difficult 
> thing for a judge to do.  Exclusionary Rule motions come in the context of 

Also, many illegal wiretaps and black bag jobs are done not to secure
evidence--which is inadmissable--but in furtherance of investigations,
and to point to evidence they _can_ get a search warrant for.  (I
submit that the FBI wants DT for largely this reason, and all the
calculations of "cost per wiretap" and how they are exorbitantly
expensive miss this essential point!)


> extent.  Targeted political organizations will be infiltrated with a much 
> greater degree of aggressiveness, perhaps even surpassing levels of the 
> 1960's.  Frustration in law enforcement inability to penetrate the more 

Probably true. In all fairness to ourselves, we actually are part of a
larger threat (notice that I'm only calling Cypherpunks a _part_ of
this, as to claim overall credit would be absurd) to the status quo
than the Black Panthers were in the 1960s. Think about it.


> More alarming perhaps are the ramifications for banking transactions.  In 
> the absence of an ability to monitor transactions electronically Human 
> Intelligence will be forced to fill in the gaps, creating a great demand 
> for informants within the banking and financial industries.  The SEC simply 
> will be unable to function as it does today without electronic monitoring 
> of transactions.  Instead brokerage firms, high profile investors and 
> financial institutions are more likely to be attacked with Human 
> Intelligence and informants, perhaps even outright theft of records.  The 
> implications for even the moderate level investor are ominous.

Indeed. But this is already occurring in a major way. The major credit
reporting agencies collude in central ways with the government (as
with the faked credentials used for the Witness Security Program, for
spies, etc.). Banks already collude (BCCI was not a fluke, just a CIA
front bank, like Castle Bank, Nugan Hand Bank, and Bank of America).

Strong crypto and anonymous systems will ultimately be _helped_ by
this duplicity, ironically.

> Given the flexibility of constitutional interpretation demonstrated by the 
> New Deal legislation, is it any mystery that the new law enforcement 
> methodology will be supported by the courts, especially in the face of 
> complete law enforcement breakdown?

I go further on this point even than Black Unicorn does. I think
there's a reasonable chance that a "state of national emergency" will
be declared. Lots of things could trigger this, and I don't think it's
just millenialist paranoia to believe certain Emergency Orders could
be triggered. Military manouvers have planned for this (REX-84,
Operation Night Train, FEMA, etc.). 

> The Cypherpunks must ask themselves how to address these issues, and 
> recognize the potential political impact of high technology and the losing 
> law enforcement battle to keep up.  Would a Cypherpunk victory merely be 
> bypassed by a clever end run?  Is this a case of "Even when you win you 
> lose"?

Important for us to think about these issues, to be sure.

--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
Cypherpunks list: majordomo@toad.com with body message of only: 
subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tcmay