4 ms·

"(3) Encryption A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encryp

"(3) Encryption A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication." http://www.law.cornell.edu/uscode/text/47/1002 http://www.law.cornell.edu/uscode/text/47/1002 "18 U.S. Code § 2703 - Required disclosure of customer communications or records (a) Contents of Wire or Electronic Communications in Electronic Storage.— A governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less, only pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures) by a court of competent jurisdiction. A governmental entity may require the disclosure by a provider of electronic communications services of the contents of a wire or electronic communication that has been in electronic storage in an electronic communications system for more than one hundred and eighty days by the means available under subsection (b) of this section. (b) Contents of Wire or Electronic Communications in a Remote Computing Service.— ... (c) Records Concerning Electronic Communication Service or Remote Computing Service. ..." http://www.law.cornell.edu/uscode/text/18/2703 http://www.law.cornell.edu/uscode/text/18/2703

declan 12y ago
The first statute you're quoting, 47 USC 1002, was part of the 1994 CALEA legislation. A basic principle of legal interpretation is that newer laws trump old ones if that is clearly the legislative intent. So if the 1997 ban-strong-crypto bill had been enacted, it would have overriden that portion of CALEA -- effectively repealing it -- to the extent it was in conflict. Put another way, if Congress has the power to say X one year, they typically have the power to say not(X) the next year.
- xnull2guest 12y ago
  It would be interesting to see what a crypto ban would do if it were to override CALEA and the Stored Communications Act. Where a key escrow solution was previously required, a sudden ban on encryption would do what - force the companies to change key sizes? Since companies are already required to give plaintext access to communications and records (if they provide the security themselves), what difference would a crypto-ban really achieve other than removing the companies in question from knowing which records law enforcement sought to access?
  - declan 12y ago
    Well, there is no U.S. law requiring key escrow. There are a very few laws that impose escrow-like requirements on some sectors. If you're a financial services firm you may be required to monitor employees' email, which makes some forms of encryption tricky. And even the CALEA excerpt you quoted above authorizes telecom carriers to provide secure end-to-end crypto (they wouldn't have "the information necessary to decrypt the communication"). CALEA doesn't apply to the tech firms HN knows and loves; they're not telecom carriers, a term of art. But putting all that aside for the moment, banning crypto without backdoors would, at a minimum, create real difficulties for U.S. companies and require many open source/free software projects to move overseas. It would also make felons of many HN readers. That's no exaggeration; an ex-Mozilla fellow now building the crypton.io framework wrote to me this evening saying: "That bill would have made my work criminal." https://twitter.com/deezthugs/status/556678844120576000 https://twitter.com/deezthugs/status/556678844120576000 To be clear, I don't believe the FBI|NSA|DOJ|DEA|DHS|CIA|etc. cadre of TLAs are pushing for a ban on domestic crypto now. But they tend to take the long view. Look very carefully at what is eventually proposed. Is it a ban on whole-disk encryption without backdoors? Would it extend to PCs? What about open source projects and AOSP? Would mere possession of non-backdoored crypto be a crime, or distribution, or commercial sale? Etc. I view a lot of this as the Feds trying to pressure Apple and Google into adopting an escrowed solution for encrypted devices -- without actually enacting a law. Laws are public, subject to legal challenge (a federal appeals court in the Junger case held there are 1A issues involved in a crypto ban), and tend not to make it through Congress very quickly. But extralegal pressure can be applied in secret, is not subject to legal challenge, and can happen much sooner. HN threads in the past have discussed some of these extralegal pressures that can be brought to bear. Multi-billion dollar .gov contracts are a big one too.
honeybooboo123 12y ago
You do know laws don't apply to rulers, but only their subjects, don't you? Don't you think the all-encompassing surveillance violates the 4th Amendment? It's clearly unconstitutional, but does the NSA give a fuck? What happened to habeas corpus with Bradley Manning? Is it legal for highway patrol officers to just plain loot innocent drivers? (Would it matter if it were?) Don't cite laws in defense of whatever the government is doing. When you're even half-awake to reality, you know laws are just meaningless noise. Here's a simple guide: Lawful = Good = Whatever your rulers want you to do. Unlawful = Bad = Whatever your rulers DON'T want you to do. Terrorist = Thought-Criminal = Someone who might conceivably pose a threat to the government.

declan 12y ago

The first statute you're quoting, 47 USC 1002, was part of the 1994 CALEA legislation. A basic principle of legal interpretation is that newer laws trump old ones if that is clearly the legislative intent. So if the 1997 ban-strong-crypto bill had been enacted, it would have overriden that portion of CALEA -- effectively repealing it -- to the extent it was in conflict. Put another way, if Congress has the power to say X one year, they typically have the power to say not(X) the next year.

xnull2guest 12y ago
It would be interesting to see what a crypto ban would do if it were to override CALEA and the Stored Communications Act. Where a key escrow solution was previously required, a sudden ban on encryption would do what - force the companies to change key sizes? Since companies are already required to give plaintext access to communications and records (if they provide the security themselves), what difference would a crypto-ban really achieve other than removing the companies in question from knowing which records law enforcement sought to access?
- declan 12y ago
  Well, there is no U.S. law requiring key escrow. There are a very few laws that impose escrow-like requirements on some sectors. If you're a financial services firm you may be required to monitor employees' email, which makes some forms of encryption tricky. And even the CALEA excerpt you quoted above authorizes telecom carriers to provide secure end-to-end crypto (they wouldn't have "the information necessary to decrypt the communication"). CALEA doesn't apply to the tech firms HN knows and loves; they're not telecom carriers, a term of art. But putting all that aside for the moment, banning crypto without backdoors would, at a minimum, create real difficulties for U.S. companies and require many open source/free software projects to move overseas. It would also make felons of many HN readers. That's no exaggeration; an ex-Mozilla fellow now building the crypton.io framework wrote to me this evening saying: "That bill would have made my work criminal." https://twitter.com/deezthugs/status/556678844120576000 https://twitter.com/deezthugs/status/556678844120576000 To be clear, I don't believe the FBI|NSA|DOJ|DEA|DHS|CIA|etc. cadre of TLAs are pushing for a ban on domestic crypto now. But they tend to take the long view. Look very carefully at what is eventually proposed. Is it a ban on whole-disk encryption without backdoors? Would it extend to PCs? What about open source projects and AOSP? Would mere possession of non-backdoored crypto be a crime, or distribution, or commercial sale? Etc. I view a lot of this as the Feds trying to pressure Apple and Google into adopting an escrowed solution for encrypted devices -- without actually enacting a law. Laws are public, subject to legal challenge (a federal appeals court in the Junger case held there are 1A issues involved in a crypto ban), and tend not to make it through Congress very quickly. But extralegal pressure can be applied in secret, is not subject to legal challenge, and can happen much sooner. HN threads in the past have discussed some of these extralegal pressures that can be brought to bear. Multi-billion dollar .gov contracts are a big one too.

honeybooboo123 12y ago

You do know laws don't apply to rulers, but only their subjects, don't you? Don't you think the all-encompassing surveillance violates the 4th Amendment? It's clearly unconstitutional, but does the NSA give a fuck? What happened to habeas corpus with Bradley Manning? Is it legal for highway patrol officers to just plain loot innocent drivers? (Would it matter if it were?) Don't cite laws in defense of whatever the government is doing. When you're even half-awake to reality, you know laws are just meaningless noise. Here's a simple guide: Lawful = Good = Whatever your rulers want you to do. Unlawful = Bad = Whatever your rulers DON'T want you to do. Terrorist = Thought-Criminal = Someone who might conceivably pose a threat to the government.