=========================================================================
________________ _______________ _______________
/_______________/\ /_______________\ /\______________\
\\\\\\\\\\\\\\\\\ \ ||||||||||||||||| / ////////////////
\\\\\\\\\\\\\\\\\/ ||||||||||||||||| / ////////////////
\\\\\\_______/\ ||||||_______\ / //////_____\
\\\\\\\\\\\\\ \ |||||||||||||| / /////////////
\\\\\\\\\\\\\/____ |||||||||||||| / /////////////
\\\\\___________/\ ||||| / ////
\\\\\\\\\\\\\\\\ \ ||||| / ////
\\\\\\\\\\\\\\\\/ ||||| \////
=========================================================================
EFFector Online Volume 07 No. 12 July 22, 1994 editors@eff.org
A Publication of the Electronic Frontier Foundation ISSN 1062-9424
In This Issue:
EFF Analysis of Vice-President Gore's Letter on Cryptography Policy
EFF Reactions to Encryption Standards & Procedures Act (07/12/94 Draft)
NSA Letter to Sen. Hollings Re: Clipper Appropriation Draft Bill
Interoperability Demo - ISDN and Internet PPP
EFF Congratulates Rep Markey on Passage of Open Platform Bill HR3636
US ACM Calls for Clipper Withdrawal, Releases Crypto Policy Report
IITF Intellectual Property Draft Report - Request for Comments
New Faces at EFF - Robin Abner (Membership), Darby Costello (Finance)
What YOU Can Do
----------------------------------------------------------------------
Subject: EFF Analysis of Vice-President Gore's Letter on Cryptography Policy
----------------------------------------------------------------------------
July 22, 1994
Two days ago, Vice-President Al Gore signaled a major setback in the
Administration's Clipper program, and a willingness to engage in serious
negotiations leading to a comprehensive new policy on digital privacy and
security. Many questions remain about the future, but one thing is
certain: Clipper is a dead end, and those of us who are concerned about
digital privacy have won a new opportunity to shape a better policy.
The Vice-President's letter to Rep. Maria Cantwell (D-WA) made it clear
that while Clipper might have a small place in the telephone security
market, it has no future in the digital world. "...[T]he Clipper Chip is
an approved federal standard for telephone communications and not for
computer networks and video networks. For that reason, we are working with
industry to investigate other technologies for those applications.... We
welcome the opportunity to work with industry to design a more versatile,
less expensive system. Such a key escrow system would be implementable in
software, firmware, hardware, or any combination thereof, would not rely
upon a classified algorithm, would be voluntary, and would be exportable."
Clipper does not meet most of these criteria, so, according to the Vice-
President, it is a dead end.
END OF THE LINE FOR CLIPPER -- LONG-RUN EFFORT TO DRIVE MARKET WILL FAIL
The premise of the Clipper program was that the government could drive the
market toward use of encryption products which incorporated
government-based key escrow agents. A series of subtle and not so subtle
government actions would encourage private citizens to use this technology,
thus preserving law enforcement access to encrypted communications.
Clipper was originally announced as the first element of a family of
hardware-based, government key escrow encryption devices that would meet
security needs for both voice and data communications on into the future.
Clipper itself was purely a voice and low-speed data product, but other
members of the Skipjack family, including Tessera and Capstone, were to be
compatible with Clipper and were intended to lead the way from escrowed
encryption in voice to escrowed encryption for data. Plans are already
announced, in fact, to use Tessera and Capstone in large government email
networks. At the time, the hope was that government use of this technology
would push private sector users toward key escrow systems as well.
Now, the announcement that the Administration is re-thinking plans for data
encryption standards leaves Clipper a stranded technology. No one wants to
buy, or worse yet, standardize on, technology which has no upgrade path.
As a long-run effort to force the market toward government-escrowed
encryption standards, Clipper is a failure.
WE STILL MUST WORK FOR VOLUNTARY, OPEN, EXPORTABLE STANDARDS
The fight for privacy and security in digital media is by no means over.
Though the Administration has backed away from Clipper, and expressed
willingness to talk about other solutions, we are pursuing serious progress
on the following issues:
* Improved telephone encryption standards
For the reasons listed by the Vice-President, in addition to the inherent
problems of making copies of all your keys available, Clipper is a poor
choice for telephone encryption. Industry should develop a standard for
truly secure and private telephones, make them available from multiple
manufacturers worldwide, and make them interoperate securely with audio
conferencing software on multimedia PC's.
* Truly voluntary standards
Any cryptographic standard adopted by the government for private sector use
must be truly voluntary. Voluntary means, to us, that there are statutory
guarantees that no citizen will be required or pressured into using the
standard for communications with the government, or with others. No
government benefits, services, or programs should be conditioned on use of
a particular standard, especially if it involves government or private key
escrow.
* Open standards
Standards chosen must be developed in an open, public process, free from
classified algorithms. The worldwide independent technical community must
be able to create and evaluate draft standards, without restriction or
government interference, and without any limits on full participation by
the international cryptographic community.
* No government escrow systems
Any civilian encryption standard which involves government getting copies
of all the keys poses grave threats to privacy and civil liberties, and is
not acceptable in a free society.
* Liberalization of export controls
Lifting export controls on cryptography will make the benefits of strong
cryptography widely available to our own citizens. U.S. hardware, software
and consumer electronics manufacturers will build encryption into
affordable products once they are given access to a global marketplace.
Today's widespread availability of "raw" cryptographic technology both
inside and outside the United States shows that the technology will always
be available to "bad guys".
The real question is whether our policies will allow encryption to be built
into the fabric of our national and international infrastructure, to
provide significantly increased individual privacy, improved financial
privacy, increased financial security, enhanced freedom of association,
increased individual control over identity, improved security and integrity
of documents, contracts, and licenses, reduced fraud and counterfeiting,
the creation of significant new markets for buying and selling of
intellectual property, and a lessened ability to detect and prosecute
victimless crimes.
These benefits are not free, however. EFF does recognize that new
communications technologies pose real challenges to the work of law
enforcement. Just as the automobile, the airplane, and even the telephone
created new opportunities for criminal activity, and new difficulties for
law enforcement, encryption technology will certainly require changes in
traditional investigative techniques. We also recognize that encryption
will prevent many of the online crimes that will likely occur without it.
We further believe that these technologies will create new investigative
tools for law enforcement, even as they obsolete old ones. Entering this
new environment, private industry, law enforcement, and private citizens
must work together to balance the requirements of both liberty and
security.
Finally, the export controls used today to attempt to control this
technology are probably not Constitutional under the First Amendment; if
the problems of uncontrolled export are too great, a means of control must
be found which does not restrict free expression.
CONGRESSIONAL LEADERSHIP TOWARD COMPREHENSIVE POLICY FRAMEWORK IS CRITICAL
The efforts of Congresswoman Maria Cantwell, Senator Patrick Leahy, and
other members of Congress, show that comprehensive policies on privacy,
security and competitiveness in digital communication technologies can only
be achieved with the active involvement of Congress. Unilateral policy
efforts by the Executive branch, such as Clipper and misguided export
control policies, will not serve the broad interests of American citizens
and businesses. So, we are pleased to see that the Vice-President has
pledged to work with the Congress and the private sector in shaping a
forward-looking policy. We see the Vice-President's letter to
Congresswoman Cantwell as an important opening for dialogue on these
issues.
The principles of voluntariness and open standards announced in the Vice-
President's letter, as well as those mentioned here, must be incorporated
into legislation. We believe that under the leadership of Senator Leahy,
Reps. Cantwell, Valentine, Brooks and others, this will be possible in the
next congress. EFF is eager to work with the Congress, the Administration,
along with other private sector organizations to help formulate a new
policy. EFF is also pleased to be part of the team of grass roots
activism, industry lobbying, and public interest advocacy which has yielded
real progress on these issues.
FOR MORE INFORMATION CONTACT:
Jerry Berman, Executive Director
Daniel J. Weitzner, Deputy Policy Director
For the full text of the Gore/Cantwell letter, see:
ftp.eff.org, /pub/Alerts/gore_clipper_retreat_cantwell_072094.letter
gopher.eff.org, 1/Alerts, gore_clipper_retreat_cantwell_072094.letter
http://www.eff.org/pub/Alerts/gore_clipper_retreat_cantwell_072094.letter
------------------------------
Subject: EFF Reactions to Encryption Standards & Procedures Act (Draft)
-----------------------------------------------------------------------
The staff of the House Science, Space, and Technology Committee has just
released a draft bill which would create a somewhat more public process for
establishment of Clipper-like escrowed encryption systems. Entry of the
Congress into this policy debate is a welcome change after 18 months of
one-sided Executive Branch edicts. However, considerable changes would be
required before the legislation would meet EFF's goals for a truly open
federal encryption policy which preserves the right of private individuals
to use any form of encryption, without restriction or penalty.
Despite its promise of an open process, this bill is by no means a
repudiation of the Clipper program, In fact, it enshrines in legislation
several key aspects of the Clipper policy. However, inasmuch as the bill
seeks to establish NIST authority to develop escrow encryption systems, it
raises real questions about whether NIST or other agencies have any
authority now to spend federal funds on escrow encryption systems.
Overview of the bill:
The bill directs the Department of Commerce, through the National Institute
of Standards and Technology, to issue escrowed encryption standards. The
standards issued would be subject to public comment and afford the
opportunity for judicial review under the terms of the Administrative
Procedures Act. Similar procedures created for the designation of
government key escrow agents.
Several aspects of the Clinton Administration's approach to cryptography
policy are accepted by this bill:
1. Absolute preservation of law enforcement and national security access
By this bill, any encryption standards adopted must "preserve the
functional ability of the government to interpret, in a timely manner,
electronic information that has been obtained pursuant to an electronic
surveillance permitted by law." Sec 31(b)(2)(E).
2. Weak privacy protection
The bill specifies that standards adopted should advance the development of
the NII, but offers only qualified support for privacy. Standards should
are only required to go so far as to not "diminish existing privacy
rights...." Sec 31(b)(2)(D).
3. Increased role for National Security Agency in civilian privacy and
security matters
The bill establishes a permanent role for the National Security Agency in
the creation of privacy and security standards for use by the private
sector. Currently, under the Computer Security Act, NIST is encouraged to
consult with the NSA on matters of federal systems security and to draw
"computer system technical security guidelines developed by the National
Security Agency to the extent that the National Bureau of Standards
determines that such guidelines are consistent with the requirements for
protecting sensitive information in Federal computer systems." This would
explicitly extend the NSA role from federal systems to systems intended for
public, civilian use. As such, this is a major change in the Computer
Security Act.
Issues to be addressed in draft:
To create a truly open policy process, to protect privacy, and to ensure
the development of the best privacy-protecting technology possible, the
bill should be augmented with the following provisions:
1. Voluntary standards
Any legislation on encryption standards must guarantee that no one will be
required to use such standards, nor will use of other encryption standards
be curtailed by law. Furthermore, federal encryption policy should
guarantee that access to government programs, opportunities, or even the
ability to communicate with the government, should never be conditioned on
the use of any escrowed encryption standard. From the first announcement
of the Clipper program, the Clinton Administration has assured the public
that escrowed encryption would remain voluntary. This promise must be
included in legislation.
2. Open design process
The draft bill does call for an open process for formation of encryption
standards. Legislation should make explicit that an open process means
that no classified algorithms or technologies may be included. Though
there was public comment on the Escrowed Encryption FIPS (the Clipper
Federal Information Processing Standard), public process in that case was
meaningless because the core technology remained behind a veil of secrecy.
3. Remedies for negligence or abuse by escrow agents
As drafted, the proposal drastically limits the liability of federal escrow
agents for all but "willful" abuse by federal employees. The escrow
agents must also be responsible for unauthorized release of keys because of
the actions of private individuals or because of negligent practices by
government agents.
4. Exploration of voluntary, private sector escrow agents
Finally, if the government is going to adopt a government-based escrow
system, it should also be required to explore the possibility of private
party escrow systems based on open standards.
The full text of the draft bill is available from EFF's archives:
ftp.eff.org, /pub/EFF/Policy/Crypto/encryp_stds_procedures_94_bill.draft
gopher.eff.org, 1/EFF/Policy/Crypto/encryp_stds_procedures_94_bill.draft
http://www.eff.org/pub/EFF/Policy/Crypto/encryp_stds_procedures_94_bill.draft
------------------------------
Subject: NSA Letter to Sen. Hollings Re: Clipper Appropriations Draft Bill
--------------------------------------------------------------------------
NATIONAL SECURITY AGENCY
CENTRAL SECURITY SERVICE
Fort George G. Meade, Maryland 20755
8 July 1994
Honorable Ernest P. Hollings
Chairman, Subcommittee on Commerce,
Justice, State and Judiciary
Committee on Appropriations
United States Senate
Washington, DC 20510-6027
Dear Senator Hollings:
We recently received a copy of a draft amendment that Senator Leahy
proposed to you that would condition expenditure of appropriated funds for
key escrow encryption (including the CLIPPER Chip) on satisfaction of
several requirements. This language will have a major impact on the
Administration's overall key escrow strategy.
We are very concerned about several aspects of the proposal. Most
importantly, this language would cause significant delays (perhaps two
years or more) in the introduction and use of escrowed key encryption
products. With such a delay, alternative, non-escrow cryptographic
products likely would become the norm in the United States and perhaps
abroad as well. Widespread use of non-escrowed encryption could
irretrievably damage our ability to encourage the use of key escrow
encryption, putting at risk law enforcement effectiveness and critical
foreign intelligence activities.
Another very significant concern is the impact of delays on major
Defense Department programs to secure its information systems that process
information regarding funds transfers, personnel data, medical files,
logistics support, and much more. Since most of that information today is
processed, transferred, and stored on unclassified and unprotected
computing and telecommunications systems, it is extremely vulnerable.
The threat to these systems is real. Already, some of our systems
have been penetrated. While we do not know who penetrated the systems, we
believe potential threats include foreign intelligence activities,
criminals, terrorists, and hackers. In addition to potential threats from
external entities, network/computer attacks could also be initiated by
"insiders". Network/computer protection within DoD is a fundamental
military readiness issue and the need for security products is immediate.
The DoD is implementing a major program to help protect
unclassified but sensitive information in the Defense Messaging System
(DMS) through the use of key escrow technology. Programming has already
begun on the first set of over 22,000 protection devices for this
application. Key escrow products will provide privacy, authentication, and
data integrity solutions for critical information system [sic]. At the
same time, escrowing of keys will preserve a mechanism for law enforcement
organizations to access these systems when lawfully authorized, e.g., in
connection with investigations of possible fraud. Delays in the process
could have sever, negative consequences for DMS.
In summary, key escrow encryption technology is vital to the
Defense Department's operational readiness and its ability to conduct
day-to-day activities, and we cannot afford to delay implementation of
these critical security products.
I recognize that you may have other questions and we are prepared
to meet with you at your convenience on this matter. I have sent a similar
letter to Senator Domenici.
/s/ J.M. McConnell
Vice Admiral, U.S. Navy
Director, NSA
------------------------------
Subject: Interoperability Demo - ISDN and Internet PPP
------------------------------------------------------
PRESS RELEASE
ISDN PPP INTEROPERABILITY DEMO
GAITHERSBURG, MD, JUNE 24, 1994 -- Today at the NIUF, seven
ISDN equipment vendors demonstrated interoperable local and wide area
network connectivity using Point-to-Point Protocol (PPP) over ISDN.
This crucial step opens the way to grand-scale interoperability of ISDN
LAN connection equipment. "National ISDN 1 and 2 worked on
standardized connectivity at the circuit level, but that wasn't enough.
Users need applications to launch connections, and remote LAN access
applications are standardizing around PPP. This interoperability
demonstration puts these vendors ahead of other ISDN vendors, who
better get with it or get left out" (according to Jay Batson, Senior Analyst
with Network Strategy Service at Forrester Research).
Seven leading US, Canadian and European vendors demonstrated
interoperable ISDN remote access to LANs:
AccessWorks Communications Inc.
Cisco Systems, Inc.
DigiBoard, Inc.
Gandalf Technologies, Inc.
IBM Corp.
netCS Informationstechnik GmbH
Network Express
Vendors and end-users accessed Internet, read their e-mail, and sent files
back home as part of the demonstration.
"For the first time, telecommuters and branch office users can choose the
equipment that they prefer. Everyone can get their equipment from
different vendors, but it all works together", said Jake Jacobson, Manager
of Advanced Communication Laboratories at JPL.
Using Basic Rate ISDN lines and LAN attachments provided by the US
National Institute for Standards and Technology (NIST), vendors
interconnected their devices and attached to local and remote LANs. As
part of the demonstration, vendors and end users accessed Internet, read
their e-mail, and sent files back home. End users and vendors alike agreed
that this will greatly promote rapid expansion of telecommuting, remote
Internet access, branch office connectivity, and other useful applications.
"The European ISDN Users Forum has also sanctioned PPP as the official
interoperability standard" said Rick Kuhlbars of netCS, Berlin, Germany
PPP is a set of protocols recommended by the Internet Engineering Task
Force (IETF) that allows LAN connection equipment to negotiate which
features and protocols will be supported by both ends of a connection.
PPP is rapidly becoming a standard for LAN connections since it allows
dissimilar products to quickly negotiate which features will be selected
for a particular connection.
Some reactions:
"Global trade requirements and business relationships compel us to
interoperate using these kinds of standards based procedures." - Stan
Kluz, Lawrence Livermore National Laboratory.
"This allows us to have students, faculty and staff select a wider array of
equipment and maintain interoperability with both Ameritech's switches
as well as the University's emerging ISDN dial in pools." - Dory Leifer,
University of Michigan.
"For the first time, users now have ISDN networking plug and play.
Vendors' network products which support these specifications assure that
they can access networks without concern as to what ISDN networking
equipment is in use on the network end." - Jeff Fritz, West Virginia
University, Chairman of the Enterprise Network Data Interconnectivity
Family (ENDIF), a working group of NIUF.
NIUF - the North American ISDN User's Forum is an association of
ISDN vendors, users, and service providers working together to promote
and improve the use of ISDN in North America.
Contacts for additional information:
Reggie Best, AccessWorks Communications Inc., (800) 248-8204,
rbest@accessworks.com.
Kevin Dickson, Cisco Systems, (415) 326-1941, kdickson@cisco.com.
Bob Downs, ENDIF liaison to IETF, Combinet, (408) 522-9020,
bdowns@combinet.com.
Jeff Fritz, ENDIF Chairman, West Virginia Univ., (304) 293-2060,
jfritz@wvnvm.wvnet.edu.
Douglas Frosst, Gandalf, Ontario, Canada, (613) 723-6500,
dfrosst@gandalf.ca.
Rick Kuhlbars, netCS, Berlin, Germany, 49.30/856 999-0,
rick@netcs.com.
Randy Sisto, Network Express, (313) 761-5005, rsisto@nei.com.
Julie Thomtez, DigiBoard, (612) 943-9020, juliet@digibd.com.
IBM, IBM ISDN Information, (919) 254-ISDN.
Respectfully Submitted,
Gerry Hopkins, ENDIF ViceChair acting for the Secretary
------------------------------
Subject: EFF Congratulates Rep Markey on Passage of Open Platform Bill HR3636
-----------------------------------------------------------------------------
Earlier this month, the House of Representatives has passed both HR 3636
and 3626. HR 3636, the Markey/Fields bill, is based on EFF's Open
Platform Proposal. HR 3626 passed on a vote of 423 to 5 (7 not voting).
HR 3636 passed on a vote of 423 to 4 (8 not voting). No amendments were
offered to either bill on the Floor.
After the votes, the bills were ordered to be combined into one bill, which
will be sent to the Senate. The Senate is currently considering its own
similar legislation.
Electronic Frontier Foundation praises passage of House Telecommunications
Bill (HR 3636), in combination with the Antitrust Reform Act (HR 3626).
Key provisions of the bill will provide affordable access to multimedia
network services for the American public
******
The Electronic Frontier Foundation (EFF) is pleased that the US
House of Representatives has passed major telecommunications legislation,
and commends all who have worked on the bill, especially Chairman Ed Markey
(D-MA). Key provisions of the legislation ensure that Open Platform
service will be made widely available to all Americans, as the first step
in the development of an interactive, multimedia information
infrastructure.
"Under the Open Platform services sections, the Federal
Communications Commission is required to issue regulations which make
switched, digital telecommunications service available and affordable for
the American public in the near term," explained Daniel J. Weitzner, Deputy
Policy Director of EFF. Many of the multimedia services that will help
increase educational opportunity in our schools, provide access to library
resources, enable distance learning, and support telecommuting, can be
delivered over network services that are available today. Yet,
telecommunications carriers have been slow in offering these services to
the public. While an interactive broadband network should be our long term
policy goal, there is no reason to wait for broadband to reap the benefits
of digital technologies such as ISDN available in the network today.
"Guided by Congress, FCC action to cause deployment and tariffing
of Open Platform services will dramatically enhance American's access to
multimedia information sources, " said Weitzner.
Mitchell Kapor, Chairman of the Board of the Foundation, praised
the efforts of Chairman Markey (D-MA) and said that an information
infrastructure "built based on Open Platform principles will be a vibrant
web of communications and information that enhance free speech and
democratic discourse. Open architecture will also enable the NII to be the
site of innovation, economic growth, and job creation."
HR 3636 recognizes that advanced telecommunications services are
becoming more important for individuals and public institutions and that
the definition of universal service should evolve over time to ensure
affordable access to such advanced services for all Americans. The bill
provides that Open Platform service should be considered as the next step
in the evolution of universal service. We can hope that in many
circumstances a more competitive market will provide high quality access at
low prices for many parts of the country. A flexible definition of
universal service will help ensure that where the market fails to provide
minimum acceptable levels of service, careful tailored regulation will help
fill the void.
For all of these reasons, the Open Platform sections have been
enthusiastically supported by a diverse coalition of public interest groups
and key players in the computer and communications industries. "The job of
ensuring openness and access to the NII is only just beginning, but the
Open Platform services that made possible by the bill take a decisive first
step in the right direction," said Weitzner.
Contacts:
Jerry Berman, Executive Director, Internet:
Daniel J. Weitzner, Deputy Policy Director, Internet:
Telephone: v: 202-347-5400 f: 202-393-5509
******
June 28, 1994
Hon. Edward Markey, Chairman
House Telecommunications & Finance Subcommittee
316 Ford House Office Building
Washington, DC 20150
Dear Chairman Markey,
We want to congratulate you and Representative Fields on the
passage of HR 3636 and to thank you for efforts and foresight in support of
the Open Platform sections of the bill. Built based on Open Platform
principles, the NII will be a vibrant web of communications and information
that enhance free speech and democratic discourse. Such an open
environment will also enable the NII to be the site of innovation, economic
growth, and job creation.
Under the Open Platform services sections, the Federal
Communications Commission is required to issue regulations which make
switched, digital telecommunications service available and affordable for
the American public in the near term. As you know, many of the multimedia
services that will help increase educational opportunity in our schools,
provide access to library resources, enable distance learning, and support
telecommuting, can be delivered over network services that are available
today. Yet, telecommunications carriers have been slow in offering these
services to the public. While an interactive broadband network should be
our long term policy goal, there is no reason to wait for broadband to reap
the benefits of digital technologies such as ISDN available in the network
today. Guided by Congress, FCC action to cause deployment and tariffing of
Open Platform services will dramatically enhance American's access to
multimedia information sources. Widely available Open Platform services
will also help jump start that multimedia information and communications
market place.
HR 3636 recognizes that advanced telecommunications services are
becoming more important for individuals and public institutions and that
the definition of universal service should evolve over time to ensure
affordable access to such advanced services for all Americans. The bill,
thus, provides that Open Platform service should be considered as the next
step in the evolution of universal service. We can hope that in many
circumstances a more competitive market will provide high quality access at
low prices for many parts of the country. Your work in creating a flexible
definition of universal service will help ensure that where the market
fails to provide minimum acceptable levels of service, careful tailored
regulation will help fill the void.
For all of these reasons, the Open Platform sections have been
enthusiastically supported by a diverse coalition of public interest groups
and key players in the computer and communications industries. The job of
ensuring openness and access to the NII is only just beginning, but the
Open Platform services that you have made possible take a decisive first
step in the right direction. Again, we commend you and your colleagues for
supporting the Open Platform services sections and promise to continue to
work with you to ensure enactment of comprehensive telecommunications
legislation with strong Open Platform provisions this year.
Sincerely,
Jerry Berman
Executive Director
------------------------------
Subject: US ACM Calls for Clipper Withdrawal, Releases Crypto Policy Report
---------------------------------------------------------------------------
From: US ACM, DC Office
U S A C M
Association for Computing Machinery, U.S. Public Policy Committee
* PRESS RELEASE *
Thursday, June 30, 1994
Contact:
Barbara Simons (408) 463-5661, simons@acm.org (e-mail)
Jim Horning (415) 853-2216, horning@src.dec.com (e-mail)
Rob Kling (714) 856-5955, kling@ics.uci.edu (e-mail)
COMPUTER POLICY COMMITTEE CALLS FOR WITHDRAWAL OF CLIPPER
COMMUNICATIONS PRIVACY "TOO IMPORTANT" FOR
SECRET DECISION-MAKING
WASHINGTON, DC The public policy arm of the oldest and
largest international computing society today urged the White
House to withdraw the controversial "Clipper Chip" encryption
proposal. Noting that the "security and privacy of electronic
communications are vital to the development of national and
international information infrastructures," the Association for
Computing Machinery's U.S. Public Policy Committee (USACM) added
its voice to the growing debate over encryption and privacy
policy.
In a position statement released at a press conference on
Capitol Hill, the USACM said that "communications security is too
important to be left to secret processes and classified
algorithms." The Clipper technology was developed by the National
Security Agency, which classified the cryptographic algorithm that
underlies the encryption device. The USACM believes that Clipper
"will put U.S. manufacturers at a disadvantage in the global
market and will adversely affect technological development within
the United States." The technology has been championed by the
Federal Bureau of Investigation and the NSA, which claim that
"non-escrowed" encryption technology threatens law enforcement and
national security.
"As a body concerned with the development of government
technology policy, USACM is troubled by the process that gave rise
to the Clipper initiative," said Dr. Barbara Simons, a computer
scientist with IBM who chairs the USACM. "It is vitally important
that privacy protections for our communications networks be
developed openly and with full public participation."
The USACM position statement was issued after completion of a
comprehensive study of cryptography policy sponsored by the ACM
(see companion release). The study, "Codes, Keys and Conflicts:
Issues in U.S Crypto Policy," was prepared by a panel of experts
representing various constituencies involved in the debate over
encryption.
The ACM, founded in 1947, is a 85,000 member non-profit
educational and scientific society dedicated to the development
and use of information technology, and to addressing the impact of
that technology on the world's major social challenges. USACM was
created by ACM to provide a means for presenting and discussing
technological issues to and with U.S. policymakers and the general
public. For further information on USACM, please call (202) 298-0842.
USACM Position on the Escrowed Encryption Standard
The ACM study "Codes, Keys and Conflicts: Issues in U.S Crypto
Policy" sets forth the complex technical and social issues
underlying the current debate over widespread use of encryption.
The importance of encryption, and the need for appropriate
policies, will increase as networked communication grows.
Security and privacy of electronic communications are vital to
the development of national and international information
infrastructures.
The Clipper Chip, or "Escrowed Encryption Standard" (EES)
Initiative, raises fundamental policy issues that must be fully
addressed and publicly debated. After reviewing the ACM study,
which provides a balanced discussion of the issues, the U.S.
Public Policy Committee of ACM (USACM) makes the following
recommendations.
1. The USACM supports the development of public policies and
technical standards for communications security in open forums in
which all stakeholders -- government, industry, and the public --
participate. Because we are moving rapidly to open networks, a
prerequisite for the success of those networks must be standards
for which there is widespread consensus, including international
acceptance. The USACM believes that communications security is
too important to be left to secret processes and classified
algorithms. We support the principles underlying the Computer
Security Act of 1987, in which Congress expressed its preference
for the development of open and unclassified security standards.
2. The USACM recommends that any encryption standard adopted by
the U.S. government not place U.S. manufacturers at a disadvantage
in the global market or adversely affect technological development
within the United States. Few other nations are likely to adopt a
standard that includes a classified algorithm and keys escrowed
with the U.S. government.
3. The USACM supports changes in the process of developing
Federal Information Processing Standards (FIPS) employed by the
National Institute of Standards and Technology. This process is
currently predicated on the use of such standards solely to
support Federal procurement. Increasingly, the standards set
through the FIPS process directly affect non-federal organizations
and the public at large. In the case of the EES, the vast
majority of comments solicited by NIST opposed the standard, but
were openly ignored. The USACM recommends that the standards
process be placed under the Administrative Procedures Act so that
citizens may have the same opportunity to challenge government
actions in the area of information processing standards as they do
in other important aspects of Federal agency policy making.
4. The USACM urges the Administration at this point to withdraw
the Clipper Chip proposal and to begin an open and public review
of encryption policy. The escrowed encryption initiative raises
vital issues of privacy, law enforcement, competitiveness and
scientific innovation that must be openly discussed.
5. The USACM reaffirms its support for privacy protection and
urges the administration to encourage the development of
technologies and institutional practices that will provide real
privacy for future users of the National Information
Infrastructure.
******
Association for Computing Machinery
PRESS RELEASE
Thursday, June 30, 1994
Contact:
Joseph DeBlasi, ACM Executive Director (212) 869-7440
Dr. Stephen Kent, Panel Chair (617) 873-3988
Dr. Susan Landau, Panel Staff (413) 545-0263
COMPUTING SOCIETY RELEASES REPORT ON ENCRYPTION POLICY
"CLIPPER CHIP" CONTROVERSY EXPLORED BY EXPERT PANEL
WASHINGTON, DC A panel of experts convened by the nation's
foremost computing society today released a comprehensive report
on U.S. cryptography policy. The report, "Codes, Keys and
Conflicts: Issues in U.S Crypto Policy," is the culmination of a
ten-month review conducted by the panel of representatives of the
computer industry and academia, government officials, and
attorneys. The 50-page document explores the complex technical
and social issues underlying the current debate over the Clipper
Chip and the export control of information security technology.
"With the development of the information superhighway,
cryptography has become a hotly debated policy issue," according
to Joseph DeBlasi, Executive Director of the Association for
Computing Machinery (ACM), which convened the expert panel. "The
ACM believes that this report is a significant contribution to the
ongoing debate on the Clipper Chip and encryption policy. It cuts
through the rhetoric and lays out the facts."
Dr. Stephen Kent, Chief Scientist for Security Technology
with the firm of Bolt Beranek and Newman, said that he was
pleased with the final report. "It provides a very balanced
discussion of many of the issues that surround the debate on
crypto policy, and we hope that it will serve as a foundation for
further public debate on this topic."
The ACM report addresses the competing interests of the
various stakeholders in the encryption debate -- law
enforcement agencies, the intelligence community, industry and
users of communications services. It reviews the recent history
of U.S. cryptography policy and identifies key questions that
policymakers must resolve as they grapple with this controversial
issue.
The ACM cryptography panel was chaired by Dr. Stephen Kent.
Dr. Susan Landau, Research Associate Professor in Computer Science
at the University of Massachusetts, co-ordinated the work of the
panel and did most of the writing. Other panel members were Dr.
Clinton Brooks, Advisor to the Director, National Security Agency;
Scott Charney, Chief of the Computer Crime Unit, Criminal
Division, U.S. Department of Justice; Dr. Dorothy Denning,
Computer Science Chair, Georgetown University; Dr. Whitfield
Diffie, Distinguished Engineer, Sun Microsystems; Dr. Anthony
Lauck, Corporate Consulting Engineer, Digital Equipment
Corporation; Douglas Miller, Government Affairs Manager, Software
Publishers Association; Dr. Peter Neumann, Principal Scientist,
SRI International; and David Sobel, Legal Counsel, Electronic
Privacy Information Center. Funding for the cryptography study
was provided in part by the National Science Foundation.
The ACM, founded in 1947, is a 85,000 member non-profit
educational and scientific society dedicated to the development
and use of information technology, and to addressing the impact of
that technology on the world's major social challenges. For
general information, contact ACM, 1515 Broadway, New York, NY
10036. (212) 869-7440 (tel), (212) 869-0481 (fax).
Information on accessing the report electronically will be
posted soon on Usenet.
------------------------------
Subject: IITF Intellectual Property Draft Report - Request for Comments
-----------------------------------------------------------------------
The Information Infrastructure Task Force (IITF) working group on Intellectual
Property Rights has released their preliminary draft report for public
review and comment. The paper, "Intellectual Property and the National
Information Infrastructure," is available from the Patent & Trademark
Office via anonymous FTP from ftp.uspto.gov in /pub/nii-ip or on the Web
at URL http://www.uspto.gov/
Comments may be sent electronically to nii-ip@uspto.gov; the deadline for
comments is September 7, 1994.
------------------------------
Subject: New Faces at EFF: Robin Abner (Membership), Darby Costello (Finance)
-----------------------------------------------------------------------------
Robin Abner - Director of Membership
Robin Abner is the Director of Membership for the Electronic Frontier
Foundation. Robin works with EFF's Board and staff to plan membership
strategy and oversee marketing, administration and member services. Prior
to joining EFF, Robin was Director of Membership and Marketing at
Non-Profit Management Associates, Inc. in Washington, DC, where she
developed and administered membership programs for several non-profit
organizations. In addition, she served as Deputy Director of the Friends
of the National Library of Medicine. Robin majored in Computer Science at
George Washington University and is currently studying Technology and
Management at the University of Maryland in College Park. Robin is a member
of the American Society of Association Executives (ASAE) and is co-chair of
ASAE's Roundtable Steering Committee. In 1993, she was appointed to the
Membership Council of ASAE's Board and was awarded their Diversity Career
Development Scholarship.
******
Darby Costello - Director of Finance & Administration
Darby Costello, EFF's new Director of Finance and Administration,
handles oversight of all financial activities/transactions, human resources
and office management. Darby is a long-time Washingtonian, has worked in the
non-profit world for over 10 years, and earned a BSBA in Accounting from
George Washington University.
She is partial to cats and has two Burmese, Juan and Flor, who share their
Kalorama apartment with Darby. She is devoted to the arts (opera in
particular) and actively involved with a newly-formed local opera company.
Ms. Costello is a rabid, nearly indiscriminate, reader.
------------------------------
Subject: What YOU Can Do
------------------------
"The net poses a fundamental threat not only to the authority of the
government, but to all authority, because it permits people to organize,
think, and influence one another without any institutional supervision
whatsoever. The government is responding to this threat with the Clipper
Chip."
- John Seabrook, "My First Flame", _New_Yorker_ 06/06/94
Who will decide how much privacy is "enough"?
The Electronic Frontier Foundation believes that individuals should be
able to ensure the privacy of their personal communications through any
technological means they choose. However, the government's current
restrictions on the export of encrytion software have stifled the
development and commercial availability of strong encryption in the U.S.
Now, more than ever, EFF is working to make sure that you are the one that
makes these decisions for yourself. Our members are making themselves heard
on the whole range of issues. EFF collected over 5000 letters
of support for Rep. Maria Cantwell's bill to liberalize restrictions on
cryptography. We also gathered over 1400 letters supporting Sen. Leahy's
open hearings on the proposed Clipper encryption scheme, which were held in
May 1994. And EFF collected over 90% of the public comments that were
submitted to NIST regarding whether or not Clipper should be made a
federal standard.
You KNOW privacy is important. You have probably participated in our online
campaigns. Have you become a member of EFF yet? The best way to protect
your online rights is to be fully informed and to make your opinions heard.
EFF members are informed and are making a difference. Join EFF today!
For EFF membership info, send queries to membership@eff.org, or send any
message to info@eff.org for basic EFF info, and a membership form.
------------------------------
Administrivia
=============
EFFector Online is published by:
The Electronic Frontier Foundation
1001 G Street NW, Suite 950 E
Washington DC 20001 USA
+1 202 347 5400 (voice)
+1 202 393 5509 (fax)
+1 202 638 6119 (BBS - 16.8k ZyXEL)
+1 202 638 6120 (BBS - 14.4k V.32bis)
Internet: ask@eff.org
Internet fax gate: remote-printer.EFF@9.0.5.5.3.9.3.2.0.2.1.tpc.int
Coordination, production and shipping by:
Stanton McCandlish, Online Activist/SysOp/Archivist
Reproduction of this publication in electronic media is encouraged. Signed
articles do not necessarily represent the views of EFF. To reproduce
signed articles individually, please contact the authors for their express
permission.
To subscribe to EFFector via email, send message body of "subscribe
effector-online" (no quotes) to listserve@eff.org, which will add you a
subscription to the EFFector mailing list.
To get the latest issue, send any message to er@eff.org, and it will be
mailed to you automagically. You can also get ftp.eff.org,
/pub/EFF/Newsletters/EFFector/current.
------------------------------
Internet Contact Addresses
--------------------------
Membership & donations: membership@eff.org
Legal services: ssteele@eff.org
Hardcopy publications: pubs@eff.org
Technical questions/problems, access to mailing lists: eff@eff.org
General EFF, legal, policy or online resources queries: ask@eff.org
End of EFFector Online v07 #12
******************************
$$
