Let's Say "No!" to Single, World Versions of Software

It is imperative that Netscape, Microsoft, Qualcomm, and the other players
be pressured/urged/cajoled to commit to introducing strong, unescrowed
crypto for the *domestic* versions, even if not for export versions.

I believe several signs are pointing to jockeying in the U.S. to get the
major players in software to introduce "one version" programs with key
escrow built in. While the avowed intent will be to stop _export_ of
unescrowed strong crypto, such a "one version" (interoperable) strategy
would mean that key escrow is the de facto situation within the United
States.

Several months back, during the flap over Netscape founder Jim Clarke's
statements about the needs for key escrow, one result was that Netscape
acknowledged that even if it had to have *two* versions, a domestic version
and an export version, it would not put key escrow or other GAK versions
into U.S . releases.

It bears repeating, though we all know this: There are no restrictions
whatsoever on crypto use in the United States. (The restrictions on airwave
use of codes are more complicated to analyze, and don't effect speech,
writing, normal communications, etc.)

Not compromising on what is available to U.S. users is critical. (Of
course, we all know that what is widely available to U.S. users will
quickly become available in Europe, Asia, and elsewhere. But this is no
reason, formally, to compromise on basic freedoms within the U.S.)

So, I urge you, be prepared to attack any of the major software vendors who
offer any "one version" solutions which limit the strength of crypto
available to the U.S. customers in the name of offering a single, world,
exportable version.

Without this ITAR hook, the government is currently powerless to control
crypto domestically. (Many believe such restrictions would be dismissed on
First Amendment grounds, as restrictions on the form of speech. Of course,
many also believe the ITARs will eventually be found to be
unconstitutional, at least the parts dealilng with software, technical
articles, speech, etc.)

One of the lines of my ever-expanding .sig has been "Boycott "Big Brother
Inside" software!" I added this during the Lotus Notes flap, where Lotus
honcho Ray Ozzie was proposing his "40 + 24" solution, where Lotus would
give 24 bits of the 64-bit key to the government. When I coined the logo
"Big Brother Inside," the Cypherpunks meeting after Clipper was announced
in '93, it was this kind of cozy relationship between industry and
government I was mainly commenting on.

The NSA and FBI know that recruiting Netscape, Microsoft, Novell, Lotus,
and others to implement GAK in their stupendously popular software products
is the single best way to control the spread of strong crypto.

I say we make it clear that this will not fly for U.S. versions! What kind
of GAK gets built into products intended to be exported to Albania and Iran
is of little relevance here in the U.S., where no laws give the government
permission to dictate what is in a program, or how long a key is, or
whether master keys have been duly deposited with the secret police.

Let's remind people of this.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

Timothy C. May wrote:
> 
> It is imperative that Netscape, Microsoft, Qualcomm, and the other
> players be pressured/urged/cajoled to commit to introducing strong,
> unescrowed crypto for the *domestic* versions, even if not for export
> versions.

I'm surprised that you include Netscape in this list of companies.
We're already distributing strong unescrowed crypto in domestic version
of our products, and we will continue to do so.  What do you think we
have to be pressured into doing?

> I believe several signs are pointing to jockeying in the U.S. to get
> the major players in software to introduce "one version" programs with
> key escrow built in. While the avowed intent will be to stop _export_
> of unescrowed strong crypto, such a "one version" (interoperable)
> strategy would mean that key escrow is the de facto situation within
> the United States.

We won't do this.  Our domestic version will always contain the
strongest crypto we can provide.

-- 
You should only break rules of style if you can    | Tom Weinstein
coherently explain what you gain by so doing.      | tomw@netscape.com

-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 30 Jul 1996, Tom Weinstein wrote:

> We won't do this.  Our domestic version will always contain the
> strongest crypto we can provide.

Then what is the concern about anonymous arms-traffickers uploading the strong
crypto version to foreign FTP sites?  I recall you saying that the State
Department might revoke Netscape's "permission" to provide a domestic version
if it was exported.

- -- Mark

PGP encrypted mail prefered
Key fingerprint = d61734f2800486ae6f79bfeb70f95348
http://www.voicenet.com/~markm/  


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMf+5XLZc+sv5siulAQGtCAQApSlizPMEOk5pz2FUuHgJC+VTDzBCzmfi
zGPFdRCZMFTqovBA1+IoFFtUAbJzejfo+fglgt/tfV6nkxj8ThUwtXj1dFlFbrat
7l0Citoo3J7WUS0Y95SLh8EWb2UKoJGfyHkCz5RGt4PMaQSddXnGk2MppE1giCxm
jmMqleiOuVU=
=k7vj
-----END PGP SIGNATURE-----

At 5:16 PM -0400 7/31/96, Tom Weinstein wrote:
> The only thing they can revoke is their permission to provide it for
> download over the internet.  They can't revoke our permission to sell
> it in stores or via snail mail.

Which, of course, would kill your business.



Cheers,
Bob Hettinga


-----------------
Robert Hettinga (rah@shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"'Bart Bucks' are not legal tender."
                -- Punishment, 100 times on a chalkboard,
                       for Bart Simpson
The e$ Home Page: http://www.vmeng.com/rah/

Mark M. wrote:
> On Tue, 30 Jul 1996, Tom Weinstein wrote:
> 
>> We won't do this.  Our domestic version will always contain the
>> strongest crypto we can provide.
> 
> Then what is the concern about anonymous arms-traffickers uploading
> the strong crypto version to foreign FTP sites?  I recall you saying
> that the State Department might revoke Netscape's "permission" to
> provide a domestic version if it was exported.

The only thing they can revoke is their permission to provide it for
download over the internet.  They can't revoke our permission to sell
it in stores or via snail mail.

-- 
You should only break rules of style if you can    | Tom Weinstein
coherently explain what you gain by so doing.      | tomw@netscape.com

> The only thing they can revoke is their permission to provide it for
> download over the internet.  They can't revoke our permission to sell
> it in stores or via snail mail.

	Where do you get this idea? Got an inside track into the minds
of the supreme court?

-- 
Sameer Parekh					Voice:   510-986-8770
Community ConneXion, Inc.			FAX:     510-986-8777
The Internet Privacy Provider
http://www.c2.net/				sameer@c2.net

sameer wrote:
> 
>> The only thing they can revoke is their permission to provide it for
>> download over the internet.  They can't revoke our permission to sell
>> it in stores or via snail mail.
> 
>         Where do you get this idea? Got an inside track into the minds
> of the supreme court?

The "they" mentioned above is the State Department.  Congress can try
to do anything.

-- 
You should only break rules of style if you can    | Tom Weinstein
coherently explain what you gain by so doing.      | tomw@netscape.com

Tom Weinstein writes:

: Mark M. wrote:
: > On Tue, 30 Jul 1996, Tom Weinstein wrote:
: > 
: >> We won't do this.  Our domestic version will always contain the
: >> strongest crypto we can provide.
: > 
: > Then what is the concern about anonymous arms-traffickers uploading
: > the strong crypto version to foreign FTP sites?  I recall you saying
: > that the State Department might revoke Netscape's "permission" to
: > provide a domestic version if it was exported.
: 
: The only thing they can revoke is their permission to provide it for
: download over the internet.  They can't revoke our permission to sell
: it in stores or via snail mail.

Why can't they?  What steps do you take to make sure that the people
you sell it to aren't--gasp--foreign persons?

--
Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH
Internet:  junger@pdj2-ra.f-remote.cwru.edu    junger@samsara.law.cwru.edu

Peter D. Junger wrote:
> 
> Tom Weinstein writes:
> 
> : The only thing they can revoke is their permission to provide it for
> : download over the internet.  They can't revoke our permission to
> : sell it in stores or via snail mail.
> 
> Why can't they?  What steps do you take to make sure that the people
> you sell it to aren't--gasp--foreign persons?

We only ship the domestic version to addresses inside the US.  They
State Department seems to think this is sufficient.  Of course, a
foreign person can always fly here and pick up a copy at Fry's, but
that's not our problem.

-- 
You should only break rules of style if you can    | Tom Weinstein
coherently explain what you gain by so doing.      | tomw@netscape.com

Tom Weinstein writes:

> We only ship the domestic version to addresses inside the US.  They
> State Department seems to think this is sufficient.  Of course, a
> foreign person can always fly here and pick up a copy at Fry's, but
> that's not our problem.

Or just walk out of a Mission, and buy one on K Street.

But it's easier to just get an account on an ISP.

I recall several chats with a .nl UN Mission Staffer. He was on
Panix or PSI or such. Maybe we should require proof of citizenship
before granting a license to use IP.

(The irony was, he did not realize the Vienna Convention
covered his rented residence as well as the Mission...)


-- 
A host is a host from coast to coast.................wb8foz@nrk.com
& no one will talk to a host that's close........[v].(301) 56-LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433