14 ms·

“It shall be unlawful for any person to manufacture..encryption products” (1997)

95 points by declan 12y ago

tbrake 12y ago
Am I reading this GPO link wrong or did that not make it in? Section 2804 here actually eliminates an enforced key escrow, so I don't know. http://www.gpo.gov/fdsys/pkg/BILLS-106hr850rh/pdf/BILLS-106hr850rh.pdf http://www.gpo.gov/fdsys/pkg/BILLS-106hr850rh/pdf/BILLS-106h...
- new299 12y ago
  Section 2804 refers to products manufactured and used in the US. But section 2803 is pretty clear: "New section 2803 will make it unlawful after January 31, 2000, to sell in interstate or foreign commerce any encryption product that does not provide duly authorized persons an immediate access to plaintext capability, or immediate decryption capability." and "Sec. 2803. Unlawful sale of encryption Whoever, after January 31, 2000, sells in interstate or foreign commerce any encryption product that does not include features or functions permitting duly authorized persons immediate access to plaintext or immediate decryption capabilities shall be imprisoned for not more than 5 years, fined under this title, or both." I don't know what this document is, or what it's relevance is, but that was my reading.
  - tbrake 12y ago
    The document seemed to be a report (suggestion) to alter the SAFE Act to include those provisions. The GPO link I shared doesn't list those recommendations so it looked like they didn't make it in to the final draft. So I'm not sure what the purpose of the original linked document is either.I've edited my original comment to make it clear since it was ambiguous as to what I may have been "reading wrong".
    - new299 12y ago
      Ah I see. Thanks! I guess one take away from this document is that there have been attempts to limit the availability of encryption for at least 20 years. But I think that's relatively well known.
  - Morphling 12y ago
    This might be a bit of a stretch, but if you were to send in plain text just something meta-ish like datetime and the actual message would be sent as image for example, could we get around this? E.g. when your-favorite-three-letter-agency comes asking for decryption you just decrypt the plaintext portion for them?
    - watt 12y ago
      You still are thinking about technological measures where a vehement political response is needed. In long run, you can't keep running and hiding. You stand up and stand your ground.
- yuhong 12y ago
  The GPO link is from the 106th Congress. The original link was from the 105th.
- declan 12y ago
  The history here is non-intuitive; I'll try to explain it. I was living in DC during the Crypto Wars of the late 1990s and covering them as a reporter (I've since shifted to working on http://recent.io/ http://recent.io/, of course). The SAFE Act as originally introduced in the House of Representatives was designed to be generally pro-crypto by relaxing export controls. But as it made its way through the various committees, the anti-crypto forces got their hands on it and turned it on its head. It became a ban-non-backdoored-crypto bill instead. More precisely, in 1997, a House committee approved a ban on domestic encryption without backdoors for .gov access. Here's an excerpt from the amended anti-crypto version of the SAFE Act: "After January 31, 2000, it shall be unlawful for any person to manufacture for distribution, distribute, or import encryption products intended for sale or use in the United States, unless that product [...] permits immediate decryption of the encrypted data..." Here's how one of the anti-crypto politicos, Rep. Bill McCollum, who went on to be Florida's attorney general, justified it while debating the House Judiciary version of that bill: "Because this bill will promote greater use of stronger encryption, law enforcement may not be able to gather evidence that it can use to investigate and prosecute cases. Imagine a situation where the police with a search warrant seize the computer of a terrorist but cannot decrypt the list of people and places that he intends to strike next. Or the situation where the police seize the computer of a purveyor of child pornography but cannot decrypt the files to download the images to prosecute him." http://www.techlawjournal.com/cong106/encrypt/19990324mcc.htm#1 http://www.techlawjournal.com/cong106/encrypt/19990324mcc.ht... So yes, you're right that sec. 2804 in one version of SAFE eliminates mandated key escrow. But other versions, including the one approved by that House committee in 1997, went exactly in the opposite direction.
  - tbrake 12y ago
    Cheers. If I could make a suggestion, I think this kind of history belongs with the bill text on a blog post; providing the 1997 version without commentary caused a bit of confusion. It felt a wee bit misleading/alarmist because that text - again as far as I can tell, given the text of the later version that was approved - never actually made it into the final version. As presented it makes it seem like that's the law as it stands today.
  - jacquesm 12y ago
xnull2guest 12y ago
"(3) Encryption A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication." http://www.law.cornell.edu/uscode/text/47/1002 http://www.law.cornell.edu/uscode/text/47/1002 "18 U.S. Code § 2703 - Required disclosure of customer communications or records (a) Contents of Wire or Electronic Communications in Electronic Storage.— A governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less, only pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures) by a court of competent jurisdiction. A governmental entity may require the disclosure by a provider of electronic communications services of the contents of a wire or electronic communication that has been in electronic storage in an electronic communications system for more than one hundred and eighty days by the means available under subsection (b) of this section. (b) Contents of Wire or Electronic Communications in a Remote Computing Service.— ... (c) Records Concerning Electronic Communication Service or Remote Computing Service. ..." http://www.law.cornell.edu/uscode/text/18/2703 http://www.law.cornell.edu/uscode/text/18/2703
- declan 12y ago
  The first statute you're quoting, 47 USC 1002, was part of the 1994 CALEA legislation. A basic principle of legal interpretation is that newer laws trump old ones if that is clearly the legislative intent. So if the 1997 ban-strong-crypto bill had been enacted, it would have overriden that portion of CALEA -- effectively repealing it -- to the extent it was in conflict. Put another way, if Congress has the power to say X one year, they typically have the power to say not(X) the next year.
  - xnull2guest 12y ago
    It would be interesting to see what a crypto ban would do if it were to override CALEA and the Stored Communications Act. Where a key escrow solution was previously required, a sudden ban on encryption would do what - force the companies to change key sizes? Since companies are already required to give plaintext access to communications and records (if they provide the security themselves), what difference would a crypto-ban really achieve other than removing the companies in question from knowing which records law enforcement sought to access?
rokhayakebe 12y ago
Many are quick to jump and state that we should all have 100% privacy, and that governments should not look into our communications. At the same time we are asking for the government to protect us. Something like 9-11 happens and we blame our national security officials. Something like the Boston Marathon happens and we do the same. At some point we have to choose: Natural Freedom or Societal Freedom, but we cannot have both. I for one believe that we should TRULY consider recording every message we send/receive. We should have a very high threshold for using these communications against people, and making sure they can only be used for matters of the people's security.
- chrisdone 12y ago
  > At the same time we are asking for the government to protect us. Speak for yourself.
  - rokhayakebe 12y ago
    Whether they are doing this effectively or not is up for debate, but certainly in any society it is part of the role of the government to protect its citizens. Certainly this job cannot be left to individuals or to private parties.
- vertex-four 12y ago
  > Something like 9-11 happens and we blame our national security officials. Something like the Boston Marathon happens and we do the same. Lots of people might, but a lot of the younger generation most certainly doesn't - these are black swan events. Given that they don't happen more often, I'd say the Government have more than enough power - you can't stop 100% of terrorism, just like you can't stop 100% of crime. > We should have a very high threshold for using these communications against people, and making sure they can only be used for matters of the people's security. We already have laws which empower the Government with additional powers in cases of "national security". The result? Suddenly, drug busts are national security. Now, that's not to say the Government should not have some well-thought-out powers to combat terrorism if they actually need them. What they have now, and what you are proposing, is not well-thought-out.
known 12y ago
"Never do anything against conscience even if the state demands it." --Einstein
- socceroos 12y ago
  The benefit of hindsight, eh, Einstein?
chernevik 12y ago
Could someone please post a comment or link on the state of constitutional protection for strong encryption? I think I've read that the courts have ruled that dissemination and use of strong crypto algorithms is protected by the First Amendment, but I'm not sure of that.
- frostmatthew 12y ago
  Bernstein v. United States[1] maybe? [1] https://en.wikipedia.org/wiki/Bernstein_v._United_States https://en.wikipedia.org/wiki/Bernstein_v._United_States
  - tdaltonc 12y ago
    and Junger v.Daley http://en.wikipedia.org/wiki/Junger_v._Daley http://en.wikipedia.org/wiki/Junger_v._Daley http://www.jstor.org/discover/10.2307/1342657?sid=21105098883821&uid=4&uid=2 http://www.jstor.org/discover/10.2307/1342657?sid=2110509888...
    - declan 12y ago
      This is the big one. The late Peter Junger, who brought this case, was a principled civil libertarian and law professor who deserves to be remembered for dealing the final blow to the federal government's anti-encryption regime. He was the first person to secure a precedential court decision that said this: "Because computer source code is an expressive means for the exchange of information and ideas about computer programming, we hold that it is protected by the First Amendment." http://caselaw.findlaw.com/us-6th-circuit/1074126.html http://caselaw.findlaw.com/us-6th-circuit/1074126.html (The 9th Circuit in _Bernstein_ didn't go that far, despite valiant efforts by EFF, as I recall it.) Peter was a computer tinkerer as well as a lawyer. He once did me the favor of speaking to a class I taught at Case Western, and, in addition to discussing his own encryption case, talked about setting up a mail server --I recall the school let him place a colo'd box in one of their server rooms because he was an emeritus. He also wrote an article called "You Can't Patent Software: Patenting Software Is Wrong": http://samsara-blog.blogspot.com/ http://samsara-blog.blogspot.com/ TLDR: One big reason why we haven't seen a proposed US law restricting mobile device encryption today is because of what Peter Junger did in the 1990s.
slowmovintarget 12y ago
The short version: Get it (encryption software) while you can.
- RankingMember 12y ago
  I can't imagine anyone'll be able to keep encryption software out of people's hands, even if it gets as dire as requiring fallback to sneakernet.
- strathmeyer 12y ago
  "Oh, they taught us encryption in school... and for free, on the Internet."
cogburnd02 12y ago
There are some interesting ways around government crypto restrictions. Ciphersaber [1] is designed so that you can memorize how to write a program to implement it. Bruce Schneier proposed Solitaire, [2] which is designed to be carried out with playing cards rather than on a computer. (Later, Paul Crowley discovered some weaknesses [3] in Solitaire.) Diceware [4] is a method of generating secure passphrases with (you guessed it) regular dice. [1] http://ciphersaber.gurus.org/ http://ciphersaber.gurus.org/ [2] https://www.schneier.com/solitaire.html https://www.schneier.com/solitaire.html [3] http://www.ciphergoth.org/crypto/solitaire/ http://www.ciphergoth.org/crypto/solitaire/ [4] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html

95 points by declan 12y ago

Am I reading this GPO link wrong or did that not make it in? Section 2804 here actually eliminates an enforced key escrow, so I don't know. http://www.gpo.gov/fdsys/pkg/BILLS-106hr850rh/pdf/BILLS-106hr850rh.pdf http://www.gpo.gov/fdsys/pkg/BILLS-106hr850rh/pdf/BILLS-106h...

new299 12y ago
Section 2804 refers to products manufactured and used in the US. But section 2803 is pretty clear: "New section 2803 will make it unlawful after January 31, 2000, to sell in interstate or foreign commerce any encryption product that does not provide duly authorized persons an immediate access to plaintext capability, or immediate decryption capability." and "Sec. 2803. Unlawful sale of encryption Whoever, after January 31, 2000, sells in interstate or foreign commerce any encryption product that does not include features or functions permitting duly authorized persons immediate access to plaintext or immediate decryption capabilities shall be imprisoned for not more than 5 years, fined under this title, or both." I don't know what this document is, or what it's relevance is, but that was my reading.
- tbrake 12y ago
  The document seemed to be a report (suggestion) to alter the SAFE Act to include those provisions. The GPO link I shared doesn't list those recommendations so it looked like they didn't make it in to the final draft. So I'm not sure what the purpose of the original linked document is either.I've edited my original comment to make it clear since it was ambiguous as to what I may have been "reading wrong".
  - new299 12y ago
    Ah I see. Thanks! I guess one take away from this document is that there have been attempts to limit the availability of encryption for at least 20 years. But I think that's relatively well known.
- Morphling 12y ago
  This might be a bit of a stretch, but if you were to send in plain text just something meta-ish like datetime and the actual message would be sent as image for example, could we get around this? E.g. when your-favorite-three-letter-agency comes asking for decryption you just decrypt the plaintext portion for them?
  - watt 12y ago
    You still are thinking about technological measures where a vehement political response is needed. In long run, you can't keep running and hiding. You stand up and stand your ground.
yuhong 12y ago
The GPO link is from the 106th Congress. The original link was from the 105th.
declan 12y ago
The history here is non-intuitive; I'll try to explain it. I was living in DC during the Crypto Wars of the late 1990s and covering them as a reporter (I've since shifted to working on http://recent.io/ http://recent.io/, of course). The SAFE Act as originally introduced in the House of Representatives was designed to be generally pro-crypto by relaxing export controls. But as it made its way through the various committees, the anti-crypto forces got their hands on it and turned it on its head. It became a ban-non-backdoored-crypto bill instead. More precisely, in 1997, a House committee approved a ban on domestic encryption without backdoors for .gov access. Here's an excerpt from the amended anti-crypto version of the SAFE Act: "After January 31, 2000, it shall be unlawful for any person to manufacture for distribution, distribute, or import encryption products intended for sale or use in the United States, unless that product [...] permits immediate decryption of the encrypted data..." Here's how one of the anti-crypto politicos, Rep. Bill McCollum, who went on to be Florida's attorney general, justified it while debating the House Judiciary version of that bill: "Because this bill will promote greater use of stronger encryption, law enforcement may not be able to gather evidence that it can use to investigate and prosecute cases. Imagine a situation where the police with a search warrant seize the computer of a terrorist but cannot decrypt the list of people and places that he intends to strike next. Or the situation where the police seize the computer of a purveyor of child pornography but cannot decrypt the files to download the images to prosecute him." http://www.techlawjournal.com/cong106/encrypt/19990324mcc.htm#1 http://www.techlawjournal.com/cong106/encrypt/19990324mcc.ht... So yes, you're right that sec. 2804 in one version of SAFE eliminates mandated key escrow. But other versions, including the one approved by that House committee in 1997, went exactly in the opposite direction.
- tbrake 12y ago
  Cheers. If I could make a suggestion, I think this kind of history belongs with the bill text on a blog post; providing the 1997 version without commentary caused a bit of confusion. It felt a wee bit misleading/alarmist because that text - again as far as I can tell, given the text of the later version that was approved - never actually made it into the final version. As presented it makes it seem like that's the law as it stands today.
- jacquesm 12y ago

xnull2guest 12y ago

"(3) Encryption A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication." http://www.law.cornell.edu/uscode/text/47/1002 http://www.law.cornell.edu/uscode/text/47/1002 "18 U.S. Code § 2703 - Required disclosure of customer communications or records (a) Contents of Wire or Electronic Communications in Electronic Storage.— A governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less, only pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures) by a court of competent jurisdiction. A governmental entity may require the disclosure by a provider of electronic communications services of the contents of a wire or electronic communication that has been in electronic storage in an electronic communications system for more than one hundred and eighty days by the means available under subsection (b) of this section. (b) Contents of Wire or Electronic Communications in a Remote Computing Service.— ... (c) Records Concerning Electronic Communication Service or Remote Computing Service. ..." http://www.law.cornell.edu/uscode/text/18/2703 http://www.law.cornell.edu/uscode/text/18/2703

declan 12y ago
The first statute you're quoting, 47 USC 1002, was part of the 1994 CALEA legislation. A basic principle of legal interpretation is that newer laws trump old ones if that is clearly the legislative intent. So if the 1997 ban-strong-crypto bill had been enacted, it would have overriden that portion of CALEA -- effectively repealing it -- to the extent it was in conflict. Put another way, if Congress has the power to say X one year, they typically have the power to say not(X) the next year.
- xnull2guest 12y ago
  It would be interesting to see what a crypto ban would do if it were to override CALEA and the Stored Communications Act. Where a key escrow solution was previously required, a sudden ban on encryption would do what - force the companies to change key sizes? Since companies are already required to give plaintext access to communications and records (if they provide the security themselves), what difference would a crypto-ban really achieve other than removing the companies in question from knowing which records law enforcement sought to access?

rokhayakebe 12y ago

Many are quick to jump and state that we should all have 100% privacy, and that governments should not look into our communications. At the same time we are asking for the government to protect us. Something like 9-11 happens and we blame our national security officials. Something like the Boston Marathon happens and we do the same. At some point we have to choose: Natural Freedom or Societal Freedom, but we cannot have both. I for one believe that we should TRULY consider recording every message we send/receive. We should have a very high threshold for using these communications against people, and making sure they can only be used for matters of the people's security.

chrisdone 12y ago
> At the same time we are asking for the government to protect us. Speak for yourself.
- rokhayakebe 12y ago
  Whether they are doing this effectively or not is up for debate, but certainly in any society it is part of the role of the government to protect its citizens. Certainly this job cannot be left to individuals or to private parties.
vertex-four 12y ago
> Something like 9-11 happens and we blame our national security officials. Something like the Boston Marathon happens and we do the same. Lots of people might, but a lot of the younger generation most certainly doesn't - these are black swan events. Given that they don't happen more often, I'd say the Government have more than enough power - you can't stop 100% of terrorism, just like you can't stop 100% of crime. > We should have a very high threshold for using these communications against people, and making sure they can only be used for matters of the people's security. We already have laws which empower the Government with additional powers in cases of "national security". The result? Suddenly, drug busts are national security. Now, that's not to say the Government should not have some well-thought-out powers to combat terrorism if they actually need them. What they have now, and what you are proposing, is not well-thought-out.

known 12y ago

"Never do anything against conscience even if the state demands it." --Einstein

socceroos 12y ago
The benefit of hindsight, eh, Einstein?

chernevik 12y ago

Could someone please post a comment or link on the state of constitutional protection for strong encryption? I think I've read that the courts have ruled that dissemination and use of strong crypto algorithms is protected by the First Amendment, but I'm not sure of that.

frostmatthew 12y ago
Bernstein v. United States[1] maybe? [1] https://en.wikipedia.org/wiki/Bernstein_v._United_States https://en.wikipedia.org/wiki/Bernstein_v._United_States
- tdaltonc 12y ago
  and Junger v.Daley http://en.wikipedia.org/wiki/Junger_v._Daley http://en.wikipedia.org/wiki/Junger_v._Daley http://www.jstor.org/discover/10.2307/1342657?sid=21105098883821&uid=4&uid=2 http://www.jstor.org/discover/10.2307/1342657?sid=2110509888...
  - declan 12y ago
    This is the big one. The late Peter Junger, who brought this case, was a principled civil libertarian and law professor who deserves to be remembered for dealing the final blow to the federal government's anti-encryption regime. He was the first person to secure a precedential court decision that said this: "Because computer source code is an expressive means for the exchange of information and ideas about computer programming, we hold that it is protected by the First Amendment." http://caselaw.findlaw.com/us-6th-circuit/1074126.html http://caselaw.findlaw.com/us-6th-circuit/1074126.html (The 9th Circuit in _Bernstein_ didn't go that far, despite valiant efforts by EFF, as I recall it.) Peter was a computer tinkerer as well as a lawyer. He once did me the favor of speaking to a class I taught at Case Western, and, in addition to discussing his own encryption case, talked about setting up a mail server --I recall the school let him place a colo'd box in one of their server rooms because he was an emeritus. He also wrote an article called "You Can't Patent Software: Patenting Software Is Wrong": http://samsara-blog.blogspot.com/ http://samsara-blog.blogspot.com/ TLDR: One big reason why we haven't seen a proposed US law restricting mobile device encryption today is because of what Peter Junger did in the 1990s.

slowmovintarget 12y ago

The short version: Get it (encryption software) while you can.

RankingMember 12y ago
I can't imagine anyone'll be able to keep encryption software out of people's hands, even if it gets as dire as requiring fallback to sneakernet.
strathmeyer 12y ago
"Oh, they taught us encryption in school... and for free, on the Internet."

cogburnd02 12y ago

There are some interesting ways around government crypto restrictions. Ciphersaber [1] is designed so that you can memorize how to write a program to implement it. Bruce Schneier proposed Solitaire, [2] which is designed to be carried out with playing cards rather than on a computer. (Later, Paul Crowley discovered some weaknesses [3] in Solitaire.) Diceware [4] is a method of generating secure passphrases with (you guessed it) regular dice. [1] http://ciphersaber.gurus.org/ http://ciphersaber.gurus.org/ [2] https://www.schneier.com/solitaire.html https://www.schneier.com/solitaire.html [3] http://www.ciphergoth.org/crypto/solitaire/ http://www.ciphergoth.org/crypto/solitaire/ [4] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html