Australia, EU crypto ill news, crypto wars

Just read this on comp.risks, by Ross Anderson (via a couple of people).

A crypto relevant forward if any is relavent IMO, especially this bit:

Ross Anderson <rja14@cl.cam.ac.uk> writes:
> ... While at the conference, I found out that a classified meeting
> took place this March in Germany between the signals intelligence
> agencies of the developed countries, plus Australia and South Africa,
> at which the assembled spooks agreed to press their governments to
> bring in escrow and/or weak crypto.

You realise, of course, that this means war,

Tatical replies?

a) Lobbying - hopeless IMO, they aren't interested in listening, the
   politicos are just too easy to manipulate and the "masses" aren't
   clueful enough of what crypto means to understand the implications,
   or even notice.

b) pretty good stego - possible technical solution

c) independant states of cyberspace :-)  declaration of independence


c) enforced or "enabled" by b) looks good to me.

Perhaps some literary skilled cpunk would care to compose a suitable
reply for PGN to add to risks.

Adam

----------------------------------------------------------------------
Date: Tue, 1 Aug 1995 20:36:29 -0400 (EDT)
From: "Lance J. Hoffman" <hoffman@seas.gwu.edu>
Subject: Australia next to ban PGP

Date: Tue, 01 Aug 1995 15:29:05 -0400
From: Dave Farber <farber@cis.upenn.edu>
Subject: Australia next to ban PGP [unverified info ...]

From: rja14@cl.cam.ac.uk (Ross Anderson)

Australia's proposed crypto policy:

(1)	Banks will get key escrow
(2)	Other Australian residents will be forced to use weak crypto

Source: talk by Steve Orlowski, Assistant Director, Australian attorney 
general's department, given at the Cryptography Policy and Algorithms 
Conference, Queensland University of Technology, last month.

p 34: `the needs of the majority of users of the infrastructure for
      privacy and smaller financial transactions can be met by lower 
      level encryption which could withstand a normal but not 
      sophisticated attack against it. Law enforcement agencies could 
      develop the capability to mount such sophisticated attacks. 
      Criminals who purchased the higher level encryption products 
      would immediately attract attention to themselves.'

He mentioned that his department considered itself a suitable repository
for the government central decrypting unit, which would decrypt traffic 
for local police forces. He also wants to escrowed keys for banks and 
other organisations allowed to use strong crypto. 

Centralising the wiretap capability with the AG is represented as a useful
safeguard against abuse of power by local police forces. It would be
presented as a `data recovery' facility in order to reassure the voters.

Centralisation will enable the AG to acquire the capability to use ``more 
sophisticated techniques in circumstances where the key cannot, for 
whatever reason, be recovered from escrow''.

So the technical parameters would appear to be: 40 bit keys for the 
masses, 56-bit escrowed keys for the banks, and a Wiener machine sitting
in Orlowski's office. Belt, braces and string.

Curiously enough, he quotes a `Review of long Term Cost Effectiveness
of Telecommunications Interception' as saying that ``Encryption by 
targets of their communications (both voice and data) is not considered
as a problem for TI at present in Australia'' and goes on to say that
``there has been comparatively little market for voice encryption 
products, although they have been readily available''. 

He even produces some good arguments for the EFF, such as that much of
the intelligence comes from the call log data and from calls to third 
parties such as airlines and hotels which are not encrypted.

He also says that the OECD countries will hold a meeting on National 
Cryptography Policies later this year. While at the conference, I found
out that a classified meeting took place this March in Germany between 
the signals intelligence agencies of the developed countries, plus
Australia and South Africa, at which the assembled spooks agreed to
press their governments to bring in escrow and/or weak crypto.

Australia seems rather eager to lick Uncle Sam's boots on this issue. 
I wonder what the payoff was?

Ross Anderson wrote somewhere:
> While at the conference, I found out that a classified meeting
> took place this March in Germany between the signals intelligence
> agencies of the developed countries, plus Australia and South Africa,

Does this imply that neither Australia nor SA has a sigint agency, or that
neither Australia nor SA is a developed country ?

-Futplex <futplex@pseudonym.com>

Adam wrote:

> Ross Anderson <rja14@cl.cam.ac.uk> writes:
> > ... While at the conference, I found out that a classified meeting
> > took place this March in Germany between the signals intelligence
> > agencies of the developed countries, plus Australia and South Africa,
> > at which the assembled spooks agreed to press their governments to
> > bring in escrow and/or weak crypto.
............
> a) Lobbying - hopeless IMO, they aren't interested in listening, the
>    politicos are just too easy to manipulate and the "masses" aren't
>    clueful enough of what crypto means to understand the implications,
>    or even notice.

The "masses" are not that clueless (remember the 80% against Clipper
in a US poll a year ago). The problem 'here' in the EU is the smartly
construed distance between commons and rulers. We vote for members
of a debate club (who are very generously paid out of tax money)
lacking any power whatsoever. The EU decision on crypto-policy will
emerge from closed chambers of the Commission, and in every member
country the local politicians will announce that 'it has been decided
by EU and there is nothing we can do about it, even if we would like
to'. But this doesn't mean that national freedom-of-(crypto)speech
campaigns will be useless. Civil disobedience, still very common
amongst European citizens faced with ridiculous EU regulations, will
be more likely to thrive if the legitimacy of crypto regulations is
publically questioned in a continuous mode.

A significant difference between (for example) Sweden and USA
is the punishment scales. Suppose Sweden had an ITAR (which
it hasn't). Almost everyone would laughingly export PGP and Wei's
library anyway, because the remote possibility of prosecution (assuming
similarities with the current situation in the US) would hardly
feel like a threat. A conviction would result in a few 100$ fine,
maximum. In the US, where the even so remote possibility of conviction
just possibly might bring about 5 years as Buba's girlfriend, well,
that's a very different story.

An *enforced* ban on crypto in Scandinavia is remote enough that
I'm confident 'SuperStego for Windows' will be out in ver 7.3b by then.

Mats
Gynecologist & Crypto-Groupie